CVE-2026-121764 · Package
NO FIX YET · SEE WHAT TO DO
FV Flowplayer Video Player, a WordPress plugin, fails to neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can store crafted content in the plugin can run scripts in other visitors' browsers.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
WordPress sites running FV Flowplayer Video Player at or below 7.5.56.7212 are exposed. Stored XSS needs a way to place content the plugin renders, so sites where only trusted administrators post content face less risk. Sites not running this plugin can skip it.
Not affected if plugin-not-installed, trusted-editors-only
Who cares fv-flowplayer, self-hosted, wordpress
fv-wordpress-flowplayer in the WordPress admin under Plugins.wp-content/plugins/ directory and read its version header.7.5.56.7212 are affected per NVD; move to a later release than that. A fixed version is not stated in the sources.Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.