CVE-2026-117525: FV Player < 7.5.57.7212 - Unauthenticated Stored XSS via Comment Popup

Q: Are sites using the plugin affected by default?

No. Exploitation requires the non-default comment-shortcode-parsing setting to be enabled.

Q: What does an attacker need to exploit this issue?

An attacker only needs to be able to submit a comment containing a crafted shortcode attribute value. No authentication is required.

Q: When does the stored payload execute?

The payload executes when a visitor, including an administrator, plays the video associated with the malicious comment.

Q: What can be done before updating?

Disable comment shortcode parsing to remove the required exploitation condition. Review comments for crafted shortcode attribute values, particularly on videos that may be played by administrators or other users.

Published Nov 7, 2026

Updated

The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded in comments before rendering them into the media player markup, allowing an unauthenticated visitor to store a script payload in a comment that executes in the session of any visitor, including an administrator, who plays the commented video, when the non-default comment-shortcode-parsing setting is enabled.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FV Player to a version that resolves this vulnerability.
Fixed in 7.5.57.7212
Configuration
Disable the non-default comment-shortcode-parsing setting.
FV Player comment-shortcode-parsing = disabled

Event History

Nov 7, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Are sites using the plugin affected by default?

No. Exploitation requires the non-default comment-shortcode-parsing setting to be enabled.

What does an attacker need to exploit this issue?

An attacker only needs to be able to submit a comment containing a crafted shortcode attribute value. No authentication is required.

When does the stored payload execute?

The payload executes when a visitor, including an administrator, plays the video associated with the malicious comment.

What can be done before updating?

Disable comment shortcode parsing to remove the required exploitation condition. Review comments for crafted shortcode attribute values, particularly on videos that may be played by administrators or other users.

CVE-2026-117525: FV Player < 7.5.57.7212 - Unauthenticated Stored XSS via Comment Popup

Remediation

Event History

Frequently Asked Questions

Are sites using the plugin affected by default?

What does an attacker need to exploit this issue?

When does the stored payload execute?

What can be done before updating?

Company

Resources

Contact

Frequently Asked Questions

Are sites using the plugin affected by default?

What does an attacker need to exploit this issue?

When does the stored payload execute?

What can be done before updating?