CVE-2026-121764: WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - Cross Site Scripting (XSS) vulnerability

Q: What versions are affected?

FV Flowplayer Video Player versions through 7.5.56.7212 are affected. The earliest affected version is not specified.

Q: What does an attacker need to exploit this issue?

The supplied CVSS vector indicates network reachability, low attack complexity, no privileges required, and user interaction is required. Exploitation involves stored cross-site scripting, so a user must later view content where the injected payload is rendered.

Q: What is the potential impact?

The CVSS vector indicates low confidentiality, integrity, and availability impact, with scope changed. Successful exploitation could allow script execution in a victim's browser in the context of the affected site.

Published Nov 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212.

Affected Software

1 affected component

FolioVision FV Flowplayer Video Player<=7.5.56.7212

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress FV Flowplayer Video Player plugin to a version that resolves this vulnerability.
Fixed in 7.5.57.7212

Event History

Nov 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What versions are affected?

FV Flowplayer Video Player versions through 7.5.56.7212 are affected. The earliest affected version is not specified.

What does an attacker need to exploit this issue?

The supplied CVSS vector indicates network reachability, low attack complexity, no privileges required, and user interaction is required. Exploitation involves stored cross-site scripting, so a user must later view content where the injected payload is rendered.

What is the potential impact?

The CVSS vector indicates low confidentiality, integrity, and availability impact, with scope changed. Successful exploitation could allow script execution in a victim's browser in the context of the affected site.

CVE-2026-121764: WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What versions are affected?

What does an attacker need to exploit this issue?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

What versions are affected?

What does an attacker need to exploit this issue?

What is the potential impact?