Cross-Site Scripting Flaw in FV Flowplayer Video Player Plugin by WordPress
CVE-2026-117525

Currently unrated

Key Information:

Vendor

WordPress
Status
Fv FloWPlayer Video Player
Vendor
CVE Published:
7 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-117525?

The FV Flowplayer Video Player plugin for WordPress possesses a vulnerability that allows unauthenticated users to inject malicious scripts into comments. This occurs when shortcode attributes are not properly escaped before being rendered in the media player's markup. If the comment-shortcode-parsing setting is enabled, any visitor who plays the affected video may inadvertently execute the injected script, potentially compromising their session and giving attackers a window to execute arbitrary code or capture sensitive information.

Affected Version(s)

FV Flowplayer Video Player 0 < 7.5.57.7212

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-117525 - Proof of Concept

References

https://wpscan.com/vulnerability/d731c586-6f93-4ed0-b05d-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Md Jahid Bin Sabit
WPScan
.