CVE-2026-42695: WordPress FV Flowplayer Video Player plugin <= 7.5.54.7212 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.54.7212.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/fv-wordpress-flowplayerto a version that resolves this vulnerability.Fixed in 7.5.55.7212
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates that an attacker needs low-level privileges and user interaction to exploit the vulnerability. It is remotely reachable and has low attack complexity.
What versions are affected?
FV Flowplayer Video Player versions through 7.5.54.7212 are affected. The provided data does not identify a fixed version.
What is the potential impact?
This is a stored XSS issue that can affect confidentiality, integrity, and availability at low impact levels. The scope is changed, meaning the vulnerable component could affect another security authority.