Stored Cross-Site Scripting Vulnerability in FV Flowplayer Video Player for WordPress

CVE-2026-97630

What is CVE-2026-97630?

The FV Flowplayer Video Player plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in the Unquoted popup Shortcode Attribute. This vulnerability affects all versions up to and including 7.5.54.7212. Authenticated attackers with subscriber-level access or higher can exploit this flaw to inject arbitrary web scripts into pages, which are executed whenever a user accesses an affected page. The potential for exploitation increases if the profile_videos_enable_bio option is enabled, as the malicious scripts will execute within the author bio/archive page where the profile-video shortcode is rendered.

References