---
id: "CVE-2026-121515"
page: "https://infrastack.ai/live/CVE-2026-121515"
kind: "vulnerability"
aliases: ["CVE-2026-121515"]
title: "FV Flowplayer Video Player WordPress plugin: stored script injection via comments"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["flowplayer", "package", "self-hosted", "wordpress"]
not_affected_if: ["comments-not-approved", "option-disabled", "plugin-not-installed"]
published_at: "2026-11-07T03:17:07+00:00"
first_seen_at: "2026-11-07T03:45:35+00:00"
updated_at: "2026-11-07T03:47:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121515", "first_seen_at": "2026-11-07T03:45:35+00:00"}]
exploit_sources: []
---

# FV Flowplayer Video Player WordPress plugin: stored script injection via comments

Link for people: https://infrastack.ai/live/CVE-2026-121515 (this .md is for agents)

The FV Flowplayer Video Player plugin for WordPress accepts unsanitized input in its 'comment' parameter, so an unauthenticated attacker can store a script in a page. The script runs in the browser of any visitor who opens that page once the comment is approved.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the FV Flowplayer Video Player plugin is installed and what version it is in the WordPress admin plugin list.
- Check whether the 'Parse Vimeo and YouTube links' option is enabled in the plugin settings.
- Look for injected script tags in approved comments on pages that embed Flowplayer videos.

## Fix

- The FV Flowplayer Video Player plugin: versions up to and including `7.5.56.7212` are affected; the sources do not name a fixed version.

## Timeline

- 2026-11-07T03:45:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121515

## Documents

- [fix] Patch: github.com https://github.com/foliovision/fv-wordpress-flowplayer/commit/9f224f71eb16ad01330df46c30b89e8e582cf8c8

## From the sources

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.5.56.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' option to be enabled, and the injected comment must be approved before the script executes for site visitors.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_