Stored Cross-Site Scripting in FV Flowplayer Video Player Plugin for WordPress

CVE-2026-110001

What is CVE-2026-110001?

The FV Flowplayer Video Player plugin for WordPress contains a stored cross-site scripting vulnerability due to inadequate input sanitization and output escaping for the 'align' shortcode attribute in comments. When the plugin's setting to parse Vimeo and YouTube links is enabled, this flaw allows unauthenticated attackers to inject arbitrary web scripts into pages. The malicious scripts execute when users access the affected pages, exposing them to potential exploitation. It is essential for administrators to review and configure the settings of this plugin to mitigate the risk.

References