CVE-2026-117525
FV Player < 7.5.57.7212 - Unauthenticated Stored XSS via Comment Popup
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded in comments before rendering them into the media player markup, allowing an unauthenticated visitor to store a script payload in a comment that executes in the session of any visitor, including an administrator, who plays the commented video, when the non-default comment-shortcode-parsing setting is enabled.
| Vendor | unknown |
| Product | fv flowplayer video player |
| Published | Nov 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown fv flowplayer video player
Be the first to know when new unknown vulnerabilities affecting unknown fv flowplayer video player are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / FV Flowplayer Video Player
0 < 7.5.57.7212
References
Credits
Md Jahid Bin Sabit WPScan