Stored Cross-Site Scripting in FV Flowplayer Video Player Plugin for WordPress

CVE-2026-110533

What is CVE-2026-110533?

The FV Flowplayer Video Player plugin for WordPress has a vulnerability that allows authenticated users with subscriber-level access and higher to execute arbitrary web scripts through the 'fv_player_videos[_fv_player_user_video][]' parameter. This issue arises from inadequate input sanitization and output escaping. Successful exploitation of this flaw requires the administrator to enable the 'Allow visitors to upload videos to their profile' setting, making it possible for malicious scripts to be injected into profile pages. This puts users accessing these pages at risk of exposure to harmful content.

References