CVE-2026-95807: FV Player 8 <= 8.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute
The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 8.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated visitors can also exploit this vulnerability when the 'Parse Vimeo and YouTube links' (parsecomments) setting is enabled, as this causes the plugin to process shortcodes within comment text.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
Authenticated WordPress users with Contributor-level access or higher can inject malicious script through the synopsis shortcode attribute. Unauthenticated visitors may also be able to exploit it through comment text if the “Parse Vimeo and YouTube links” (parse_comments) setting is enabled.
What happens after a successful injection?
The injected script is stored in a page and executes when another user accesses that page. This can expose or alter information available in the victim’s browser session.
Is the default configuration affected by unauthenticated comment-based exploitation?
Unauthenticated exploitation through comments requires the parse_comments setting to be enabled. The provided information does not state whether that setting is enabled by default.
What can be done while an update is not available?
Restrict Contributor and higher accounts to trusted users, review pages for suspicious FV Player shortcodes using the synopsis attribute, and disable the “Parse Vimeo and YouTube links” (parse_comments) setting to reduce comment-based exposure.