{"id":"CVE-2026-85347","kind":"vulnerability","aliases":["CVE-2026-85347"],"related":[],"title":"FV Flowplayer WordPress plugin: stored script injection by Contributor-role users","description":"The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the affected page.","summary":"The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize or escape a user-supplied value before printing it on a page. A user with the Contributor role can store a script that runs in the browser of a higher-privileged user who views the page.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fv-flowplayer","package","self-hosted","wordpress"],"not_affected_if":["no-contributor-accounts","plugin-not-installed","plugin-version-7.5.56.7212-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get fv-wordpress-flowplayer --field=version` if WP-CLI is available.\n- Confirm whether any Contributor or higher accounts can create or edit posts that use the plugin's shortcodes.","fix":"- FV Flowplayer Video Player WordPress plugin: move to `7.5.56.7212` or later.","status":"open","published_at":"2026-11-05T06:17:08+00:00","first_seen_at":"2026-11-05T06:31:52+00:00","triaged_at":"2026-11-05T06:33:08+00:00","updated_at":"2026-11-05T06:33:08+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T06:33:08Z","model":"claude-haiku-5-5","output":{"fix":"- FV Flowplayer Video Player WordPress plugin: move to `7.5.56.7212` or later.","reach":"network","title":"FV Flowplayer WordPress plugin: stored script injection by Contributor-role users","impact":"medium","summary":"The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize or escape a user-supplied value before printing it on a page. A user with the Contributor role can store a script that runs in the browser of a higher-privileged user who views the page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","fv-flowplayer","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Script runs in an administrator's browser, enabling account takeover on the site.","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get fv-wordpress-flowplayer --field=version` if WP-CLI is available.\n- Confirm whether any Contributor or higher accounts can create or edit posts that use the plugin's shortcodes.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","no-contributor-accounts","plugin-version-7.5.56.7212-or-later"],"who_is_affected":"Sites running the FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 that have users with the Contributor role or higher. The attacker needs a Contributor account, and the script runs when a higher-privileged user such as an editor or administrator views the affected page. Sites without the plugin, or where only trusted administrators can write content, carry much less risk.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000742,"input_tokens":4227,"output_tokens":639,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-85347':15A,18A '7.5.56.7212':35B,85C 'affect':127C 'allow':104C 'arbitrari':114C 'browser':66B 'contributor':10A,56B,108C 'contributor-rol':9A 'could':103C 'cve':13A,16A 'escap':40B,90C 'execut':118C 'flowplay':2A,21B,29B,79C 'fv':1A,20B,28B,78C 'fv-flowplay':19B 'higher':70B,122C 'higher-privileg':69B,121C 'host':25B 'inject':7A,113C 'output':97C 'packag':22B 'page':51B,76B,101C,128C 'player':31B,81C 'plugin':4A,33B,83C 'print':47B 'privileg':71B,123C 'role':11A,57B,109C 'run':63B 'sanit':38B,88C 'script':6A,61B,116C 'self':24B 'self-host':23B 'store':5A,59B 'suppli':44B,94C 'user':12A,43B,53B,72B,93C,105C,124C 'user-suppli':42B,92C 'valu':45B,95C 'video':30B,80C 'view':74B,125C 'web':115C 'wordpress':3A,26B,32B,82C","nicknames":[],"mitigations":[],"who_affected":"Sites running the FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 that have users with the Contributor role or higher. The attacker needs a Contributor account, and the script runs when a higher-privileged user such as an editor or administrator views the affected page. Sites without the plugin, or where only trusted administrators can write content, carry much less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fvflowplayer","medium","package","selfhosted","wordpress"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:08+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85347","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85347","severity":null,"published_at":"2026-11-05T06:17:08+00:00","modified_at":"2026-11-05T06:17:08+00:00","first_seen_at":"2026-11-05T06:31:52+00:00","fetched_at":"2026-11-05T06:31:52+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}