Stored Cross-Site Scripting Vulnerability in FV Flowplayer Video Player for WordPress

CVE-2026-109984

What is CVE-2026-109984?

The FV Flowplayer Video Player plugin for WordPress presents a vulnerability where an unauthenticated attacker can exploit insufficient input sanitization and output escaping through the 'comment' parameter. If the 'Parse Vimeo and YouTube links' option is enabled and an administrator approves a comment containing a malicious shortcode, it allows the attacker to inject arbitrary web scripts. These scripts execute when any user interacts with the video player on the affected page, potentially leading to unauthorized data access or manipulation.

References