Live › vulnerability › CVE-2026-110533
The FV Flowplayer Video Player WordPress plugin does not sanitize the fv_player_videos user video parameter, so a logged-in subscriber can store script that runs when other users open the affected page. An attacker gets script execution in the browser of whoever views the injected page, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Sites running the FV Flowplayer Video Player plugin up to and including 7.5.55.7212 where the profile video upload setting is enabled so that subscriber-level users can submit profile videos. Sites without the plugin, or with that setting off, are not exposed through this path. The sources do not say which fixed version to move to.
No product ranges from the sources yet.
7.5.55.7212 are affected.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos[_fv_player_user_video][]' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have enabled the "Allow visitors to upload videos to their profile" (profile_videos_enable_bio) setting before Subscriber-level users can submit profile videos.
This page as .md · .json · in your agent: get_signal("CVE-2026-110533")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.