{"id":"CVE-2026-117525","kind":"vulnerability","aliases":["CVE-2026-117525"],"related":[],"title":"FV Flowplayer WordPress plugin: comment shortcode lets visitors run scripts","description":"The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded in comments before rendering them into the media player markup, allowing an unauthenticated visitor to store a script payload in a comment that executes in the session of any visitor, including an administrator, who plays the commented video, when the non-default comment-shortcode-parsing setting is enabled.","summary":"The FV Flowplayer Video Player WordPress plugin does not escape shortcode attribute values embedded in comments before rendering them into player markup. An unauthenticated visitor can store a script payload in a comment that runs in the browser of anyone who plays the video, including an administrator.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fv-flowplayer","package","self-hosted","wordpress"],"not_affected_if":["default-config","plugin-updated"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; compare against `7.5.57.7212`.\n- Check whether the non-default comment shortcode parsing setting is enabled in the plugin's settings.","fix":"- FV Flowplayer Video Player: move to `7.5.57.7212` or later.","status":"open","published_at":"2026-11-07T06:16:56+00:00","first_seen_at":"2026-11-07T06:46:03+00:00","triaged_at":"2026-11-07T06:48:34+00:00","updated_at":"2026-11-07T06:48:34+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T06:48:34Z","model":"claude-haiku-5-5","output":{"fix":"- FV Flowplayer Video Player: move to `7.5.57.7212` or later.","reach":"internet","title":"FV Flowplayer WordPress plugin: comment shortcode lets visitors run scripts","impact":"high","summary":"The FV Flowplayer Video Player WordPress plugin does not escape shortcode attribute values embedded in comments before rendering them into player markup. An unauthenticated visitor can store a script payload in a comment that runs in the browser of anyone who plays the video, including an administrator.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","fv-flowplayer","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Script runs in administrator sessions when they play a commented video","analyst_note":"Sources give only the NVD entry; confirm the fixed version and any vendor advisory for CVE-2026-117525 in the plugin's changelog.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; compare against `7.5.57.7212`.\n- Check whether the non-default comment shortcode parsing setting is enabled in the plugin's settings.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config","plugin-updated"],"who_is_affected":"Sites running the FV Flowplayer Video Player plugin older than 7.5.57.7212 with the non-default comment shortcode parsing setting enabled. Sites without the plugin, on a fixed version, or with that setting off are not exposed by this description.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000718,"input_tokens":4257,"output_tokens":585,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117525':13A,16A '-2026':12A,15A '7.5.57.7212':80C 'administr':71B,120C 'allow':98C 'anyon':64B 'attribut':36B,85C 'browser':62B 'comment':5A,40B,57B,89C,109C,124C,132C 'comment-shortcode-pars':131C 'cve':11A,14A 'default':130C 'embed':38B,87C 'enabl':137C 'escap':34B,83C 'execut':111C 'flowplay':2A,19B,27B,74C 'fv':1A,18B,26B,73C 'fv-flowplay':17B 'host':23B 'includ':69B,118C 'let':7A 'markup':46B,97C 'media':95C 'non':129C 'non-default':128C 'packag':20B 'pars':134C 'payload':54B,106C 'play':66B,122C 'player':29B,45B,76C,96C 'plugin':4A,31B,78C 'render':42B,91C 'run':9A,59B 'script':10A,53B,105C 'self':22B 'self-host':21B 'session':114C 'set':135C 'shortcod':6A,35B,84C,133C 'store':51B,103C 'unauthent':48B,100C 'valu':37B,86C 'video':28B,68B,75C,125C 'visitor':8A,49B,101C,117C 'wordpress':3A,24B,30B,77C","nicknames":[],"mitigations":[],"who_affected":"Sites running the FV Flowplayer Video Player plugin older than 7.5.57.7212 with the non-default comment shortcode parsing setting enabled. Sites without the plugin, on a fixed version, or with that setting off are not exposed by this description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fvflowplayer","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-117525':13A,16A '-2026':12A,15A 'comment':5A 'cve':11A,14A 'flowplay':2A 'fv':1A 'let':7A 'plugin':4A 'run':9A 'script':10A 'shortcod':6A 'visitor':8A 'wordpress':3A","search_b":"'administr':71B 'anyon':64B 'attribut':36B 'browser':62B 'comment':40B,57B 'embed':38B 'escap':34B 'flowplay':19B,27B 'fv':18B,26B 'fv-flowplay':17B 'host':23B 'includ':69B 'markup':46B 'packag':20B 'payload':54B 'play':66B 'player':29B,45B 'plugin':31B 'render':42B 'run':59B 'script':53B 'self':22B 'self-host':21B 'shortcod':35B 'store':51B 'unauthent':48B 'valu':37B 'video':28B,68B 'visitor':49B 'wordpress':24B,30B","search_c":"'7.5.57.7212':80C 'administr':120C 'allow':98C 'attribut':85C 'comment':89C,109C,124C,132C 'comment-shortcode-pars':131C 'default':130C 'embed':87C 'enabl':137C 'escap':83C 'execut':111C 'flowplay':74C 'fv':73C 'includ':118C 'markup':97C 'media':95C 'non':129C 'non-default':128C 'pars':134C 'payload':106C 'play':122C 'player':76C,96C 'plugin':78C 'render':91C 'script':105C 'session':114C 'set':135C 'shortcod':84C,133C 'store':103C 'unauthent':100C 'valu':86C 'video':75C,125C 'visitor':101C,117C 'wordpress':77C","first_public_at":"2026-11-07T06:16:56+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117525","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117525","severity":null,"published_at":"2026-11-07T06:16:56+00:00","modified_at":"2026-11-07T06:16:56+00:00","first_seen_at":"2026-11-07T06:46:03+00:00","fetched_at":"2026-11-07T06:46:03+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}