{"id":"CVE-2026-110533","kind":"vulnerability","aliases":["CVE-2026-110533"],"related":[],"title":"FV Flowplayer WordPress plugin: stored XSS via profile video upload","description":"The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos[_fv_player_user_video][]' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have enabled the \"Allow visitors to upload videos to their profile\" (profile_videos_enable_bio) setting before Subscriber-level users can submit profile videos.","summary":"The FV Flowplayer Video Player WordPress plugin does not sanitize the fv_player_videos user video parameter, so a logged-in subscriber can store script that runs when other users open the affected page. An attacker gets script execution in the browser of whoever views the injected page, including administrators.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fv-flowplayer","package","wordpress"],"not_affected_if":["no-subscriber-accounts","plugin-not-installed","profile-video-upload-disabled"],"how_to_check":"- Check the installed version of the FV Flowplayer Video Player plugin in the WordPress admin plugins list; versions up to and including `7.5.55.7212` are affected.\n- Check whether the setting \"Allow visitors to upload videos to their profile\" (profile_videos_enable_bio) is enabled.","fix":null,"status":"open","published_at":"2026-10-30T18:17:20+00:00","first_seen_at":"2026-10-30T18:55:29+00:00","triaged_at":"2026-10-30T18:57:06+00:00","updated_at":"2026-10-30T18:57:06+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T18:57:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FV Flowplayer WordPress plugin: stored XSS via profile video upload","impact":"medium","summary":"The FV Flowplayer Video Player WordPress plugin does not sanitize the fv_player_videos user video parameter, so a logged-in subscriber can store script that runs when other users open the affected page. An attacker gets script execution in the browser of whoever views the injected page, including administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","fv-flowplayer"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Script runs in other users' browsers, including administrators, on injected pages","analyst_note":"Confirm the fixed plugin version and the vendor advisory; the sources give only the affected range.","how_to_check":"- Check the installed version of the FV Flowplayer Video Player plugin in the WordPress admin plugins list; versions up to and including `7.5.55.7212` are affected.\n- Check whether the setting \"Allow visitors to upload videos to their profile\" (profile_videos_enable_bio) is enabled.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","profile-video-upload-disabled","no-subscriber-accounts"],"who_is_affected":"Sites running the FV Flowplayer Video Player plugin up to and including 7.5.55.7212 where the profile video upload setting is enabled so that subscriber-level users can submit profile videos. Sites without the plugin, or with that setting off, are not exposed through this path. The sources do not say which fixed version to move to.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000733,"input_tokens":4257,"output_tokens":614,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110533':13A,16A '-2026':12A,15A '7.5.55.7212':106C 'access':126C,142C 'administr':72B,149C 'affect':55B 'allow':154C 'arbitrari':131C 'attack':58B,121C 'authent':120C 'bio':165C 'browser':64B 'cross':86C 'cross-sit':85C 'cve':11A,14A 'due':107C 'enabl':152C,164C 'escap':114C 'execut':61B,138C 'flowplay':2A,19B,24B,75C 'fv':1A,18B,23B,33B,74C,91C,94C 'fv-flowplay':17B 'get':59B 'includ':71B,105C 'inject':69B,130C,144C 'input':110C 'insuffici':109C 'level':125C,170C 'log':42B 'logged-in':41B 'make':116C 'open':53B 'output':113C 'packag':20B 'page':56B,70B,135C,145C 'paramet':38B,98C 'player':26B,34B,77C,92C,95C 'plugin':4A,28B,78C 'possibl':118C 'profil':8A,161C,162C,174C 'requir':147C 'run':49B 'sanit':31B,111C 'script':47B,60B,88C,133C 'set':166C 'site':87C 'store':5A,46B,84C 'submit':173C 'subscrib':44B,124C,169C 'subscriber-level':123C,168C 'upload':10A,157C 'user':36B,52B,96C,141C,171C 'version':101C 'via':7A,89C 'video':9A,25B,35B,37B,76C,93C,97C,158C,163C,175C 'view':67B 'visitor':155C 'vulner':82C 'web':132C 'whenev':139C 'whoever':66B 'wordpress':3A,21B,27B,80C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running the FV Flowplayer Video Player plugin up to and including 7.5.55.7212 where the profile video upload setting is enabled so that subscriber-level users can submit profile videos. Sites without the plugin, or with that setting off, are not exposed through this path. The sources do not say which fixed version to move to.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T18:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110533","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110533","severity":null,"published_at":"2026-10-30T18:17:20+00:00","modified_at":"2026-10-30T18:33:26+00:00","first_seen_at":"2026-10-30T18:55:29+00:00","fetched_at":"2026-10-30T18:55:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}