Stored Cross-Site Scripting Vulnerability in FV Player for WordPress

CVE-2026-95807

What is CVE-2026-95807?

The FV Player plugin for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting through the 'synopsis' Shortcode Attribute. This issue arises from inadequate sanitization of user inputs and improper output escaping. Authenticated attackers with contributor-level access can exploit this flaw to inject malicious scripts into pages, which will run whenever users visit those pages. Furthermore, unauthenticated visitors can also take advantage of this vulnerability by using the 'Parse Vimeo and YouTube links' (parse_comments) setting. When enabled, this setting processes shortcodes from comments, potentially allowing arbitrary script execution.

References