CVE-2026-85347 · Package
NO FIX YET · SEE WHAT TO DO
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize or escape a user-supplied value before printing it on a page. A user with the Contributor role can store a script that runs in the browser of a higher-privileged user who views the page.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 that have users with the Contributor role or higher. The attacker needs a Contributor account, and the script runs when a higher-privileged user such as an editor or administrator views the affected page. Sites without the plugin, or where only trusted administrators can write content, carry much less risk.
Not affected if no-contributor-accounts, plugin-not-installed, plugin-version-7.5.56.7212-or-later
Who cares fv-flowplayer, self-hosted, wordpress
wp plugin get fv-wordpress-flowplayer --field=version if WP-CLI is available.7.5.56.7212 or later.The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the affected page.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.