Stored Cross-Site Scripting Vulnerability in FV Flowplayer Video Player by WordPress

CVE-2026-121515

What is CVE-2026-121515?

The FV Flowplayer Video Player plugin for WordPress is susceptible to stored cross-site scripting through the 'comment' parameter. This vulnerability arises from inadequate input sanitization and output escaping, enabling unauthenticated attackers to inject malicious scripts that execute when users access compromised pages. To exploit this vulnerability, the 'Parse Vimeo and YouTube links' option must be activated, and the injected comment must be approved, allowing scripts to run on the site for unsuspecting visitors.

References