Stored Cross-Site Scripting Vulnerability in FV Flowplayer Video Player for WordPress
CVE-2026-97398

7.2HIGH

Key Information:

Vendor

WordPress
Status
Fv FloWPlayer Video Player
Vendor
CVE Published:
14 October 2026

What is CVE-2026-97398?

The FV Flowplayer Video Player plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. This vulnerability can be exploited by unauthenticated attackers through the 'synopsis' Shortcode Attribute. When the 'Parse Vimeo and YouTube links' option is enabled and the liststyle attribute is set to 'season', it allows attackers to inject malicious scripts into web pages. These scripts can execute when users access the compromised page, potentially leading to unauthorized actions or data breaches.

Affected Version(s)

FV Flowplayer Video Player 0 <= 7.5.54.7212

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/fv-wordpress-f...
https://plugins.trac.wordpress.org/browser/fv-wordpress-f...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

theviper17y
.