CVE-2026-110531: FV Player 8 <= 8.1.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Popup' Shortcode Attribute via Profile Video
The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fvplayervideos' parameter in all versions up to, and including, 8.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the administrator-controlled "Allow visitors to upload videos to their profile" setting to be enabled, without which the vulnerable save routine is inaccessible to Subscriber-level users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable “Allow visitors to upload videos to their profile” to prevent Subscriber-level users from accessing the vulnerable save routine.
FV Player 8 for WordPress Allow visitors to upload videos to their profile = disabled
Event History
Frequently Asked Questions
Which deployments are exposed to the subscriber-level attack path?
Sites running FV Player 8 version 8.1.9 or earlier are exposed when the administrator-controlled “Allow visitors to upload videos to their profile” setting is enabled. That setting is required for Subscriber-level users to reach the vulnerable save routine.
What access does an attacker need?
An attacker needs an authenticated WordPress account with Subscriber-level privileges or higher. No user interaction is required to submit the malicious content.
When does the injected script execute?
The script executes when a user visits a page containing the injected content. The issue can affect confidentiality and integrity in the context of the visiting user's browser session.
What can be done if updating is not immediately possible?
Disable the “Allow visitors to upload videos to their profile” setting to prevent Subscriber-level users from accessing the vulnerable save routine. This mitigation specifically addresses the documented Subscriber-level exploitation path.