{"id":"CVE-2026-110531","kind":"vulnerability","aliases":["CVE-2026-110531"],"related":[],"title":"FV Player 8 WordPress plugin: stored script injection via video field","description":"The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos' parameter in all versions up to, and including, 8.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the administrator-controlled \"Allow visitors to upload videos to their profile\" setting to be enabled, without which the vulnerable save routine is inaccessible to Subscriber-level users.","summary":"The FV Player 8 plugin for WordPress does not sanitize the 'fv_player_videos' parameter, so logged-in subscribers can save scripts into pages. Those scripts run in the browser of any user who opens the injected page.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fv-player","package","self-hosted","wordpress"],"not_affected_if":["default-config","newer-version"],"how_to_check":"- Check the installed FV Player version in the WordPress plugins screen; versions up to and including `8.1.9` are affected.\n- Check whether the setting \"Allow visitors to upload videos to their profile\" is enabled in the FV Player settings.","fix":"- FV Player 8: a fixed version is referenced in the linked patch, but the sources here do not state it; unknown.","status":"open","published_at":"2026-11-14T16:17:02+00:00","first_seen_at":"2026-11-14T16:30:58+00:00","triaged_at":"2026-11-14T16:31:34+00:00","updated_at":"2026-11-14T16:31:34+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-14T16:31:34Z","model":"claude-haiku-5-5","output":{"fix":"- FV Player 8: a fixed version is referenced in the linked patch, but the sources here do not state it; unknown.","reach":"internet","title":"FV Player 8 WordPress plugin: stored script injection via video field","impact":"medium","summary":"The FV Player 8 plugin for WordPress does not sanitize the 'fv_player_videos' parameter, so logged-in subscribers can save scripts into pages. Those scripts run in the browser of any user who opens the injected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","fv-player","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"Scripts run in visitors' browsers, exposing sessions or site actions.","analyst_note":"Confirm the fixed version of FV Player 8 from the linked patch on github.com and the vendor changelog; the sources here do not state it.","how_to_check":"- Check the installed FV Player version in the WordPress plugins screen; versions up to and including `8.1.9` are affected.\n- Check whether the setting \"Allow visitors to upload videos to their profile\" is enabled in the FV Player settings.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config","newer-version"],"who_is_affected":"Sites running FV Player 8 up to and including 8.1.9 where the \"Allow visitors to upload videos to their profile\" setting is turned on, since the vulnerable save routine is otherwise closed to subscribers. Sites without that setting enabled, or running a newer version, can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000773,"input_tokens":4681,"output_tokens":610,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110531':14A,17A '-2026':13A,16A '8':3A,29B,68C '8.1.9':93C 'access':113C,129C 'administr':137C 'administrator-control':136C 'allow':139C 'arbitrari':118C 'attack':108C 'authent':107C 'browser':56B 'control':138C 'cross':77C 'cross-sit':76C 'cve':12A,15A 'due':94C 'enabl':150C 'escap':101C 'execut':125C 'field':11A 'fv':1A,19B,27B,37B,66C,82C 'fv-player':18B 'host':24B 'inaccess':158C 'includ':92C 'inject':8A,63B,117C,131C 'input':97C 'insuffici':96C 'level':112C,162C 'log':43B 'logged-in':42B 'make':103C 'open':61B 'output':100C 'packag':21B 'page':50B,64B,122C,132C 'paramet':40B,85C 'player':2A,20B,28B,38B,67C,83C 'plugin':5A,30B,69C 'possibl':105C 'profil':146C 'requir':134C 'routin':156C 'run':53B 'sanit':35B,98C 'save':47B,155C 'script':7A,48B,52B,79C,120C 'self':23B 'self-host':22B 'set':147C 'site':78C 'store':6A,75C 'subscrib':45B,111C,161C 'subscriber-level':110C,160C 'upload':142C 'user':59B,128C,163C 'version':88C 'via':9A,80C 'video':10A,39B,84C,143C 'visitor':140C 'vulner':73C,154C 'web':119C 'whenev':126C 'without':151C 'wordpress':4A,25B,32B,71C","nicknames":[],"mitigations":[],"who_affected":"Sites running FV Player 8 up to and including 8.1.9 where the \"Allow visitors to upload videos to their profile\" setting is turned on, since the vulnerable save routine is otherwise closed to subscribers. Sites without that setting enabled, or running a newer version, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fvplayer","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-110531':14A,17A '-2026':13A,16A '8':3A 'cve':12A,15A 'field':11A 'fv':1A 'inject':8A 'player':2A 'plugin':5A 'script':7A 'store':6A 'via':9A 'video':10A 'wordpress':4A","search_b":"'8':29B 'browser':56B 'fv':19B,27B,37B 'fv-player':18B 'host':24B 'inject':63B 'log':43B 'logged-in':42B 'open':61B 'packag':21B 'page':50B,64B 'paramet':40B 'player':20B,28B,38B 'plugin':30B 'run':53B 'sanit':35B 'save':47B 'script':48B,52B 'self':23B 'self-host':22B 'subscrib':45B 'user':59B 'video':39B 'wordpress':25B,32B","search_c":"'8':68C '8.1.9':93C 'access':113C,129C 'administr':137C 'administrator-control':136C 'allow':139C 'arbitrari':118C 'attack':108C 'authent':107C 'control':138C 'cross':77C 'cross-sit':76C 'due':94C 'enabl':150C 'escap':101C 'execut':125C 'fv':66C,82C 'inaccess':158C 'includ':92C 'inject':117C,131C 'input':97C 'insuffici':96C 'level':112C,162C 'make':103C 'output':100C 'page':122C,132C 'paramet':85C 'player':67C,83C 'plugin':69C 'possibl':105C 'profil':146C 'requir':134C 'routin':156C 'sanit':98C 'save':155C 'script':79C,120C 'set':147C 'site':78C 'store':75C 'subscrib':111C,161C 'subscriber-level':110C,160C 'upload':142C 'user':128C,163C 'version':88C 'via':80C 'video':84C,143C 'visitor':140C 'vulner':73C,154C 'web':119C 'whenev':126C 'without':151C 'wordpress':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T16:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110531","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110531","severity":null,"published_at":"2026-11-14T16:17:02+00:00","modified_at":"2026-11-14T16:17:03+00:00","first_seen_at":"2026-11-14T16:30:58+00:00","fetched_at":"2026-11-14T16:30:58+00:00","note":null}],"documents":[{"id":156900,"url":"https://github.com/foliovision/fv-wordpress-flowplayer/commit/1c936e8100989c34e08415adfcb5ea3db2109902","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}