CVE-2026-85347: FV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox Caption

Q: Who can exploit this issue?

A user with the WordPress Contributor role or any higher-privileged role can supply the malicious value. Exploitation requires a higher-privileged user to view the affected page.

Q: Which plugin versions are affected?

FV Flowplayer Video Player versions before 7.5.56.7212 are affected. Version 7.5.56.7212 is the first version not identified as affected by the provided data.

Q: What input is vulnerable?

The vulnerable input is the Text Lightbox Caption value. A crafted caption can cause arbitrary web scripts to be output in a page and execute in the viewing user's browser.

Published Nov 5, 2026

Updated

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the affected page.

Event History

Nov 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

A user with the WordPress Contributor role or any higher-privileged role can supply the malicious value. Exploitation requires a higher-privileged user to view the affected page.

Which plugin versions are affected?

FV Flowplayer Video Player versions before 7.5.56.7212 are affected. Version 7.5.56.7212 is the first version not identified as affected by the provided data.

What input is vulnerable?

The vulnerable input is the Text Lightbox Caption value. A crafted caption can cause arbitrary web scripts to be output in a page and execute in the viewing user's browser.

CVE-2026-85347: FV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox Caption

Event History

Frequently Asked Questions

Who can exploit this issue?

Which plugin versions are affected?

What input is vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which plugin versions are affected?

What input is vulnerable?