CVE-2026-97398: FV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' (parsecomments) option to be enabled and the liststyle attribute set to "season" for the vulnerable code path to be reached.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the 'Parse Vimeo and YouTube links' option to prevent the vulnerable code path from being reached.
FV Flowplayer Video Player for WordPress parse_comments = disabled
Event History
Frequently Asked Questions
Which installations are exposed to this issue?
FV Flowplayer Video Player installations running version 7.5.54.7212 or earlier are affected when the "Parse Vimeo and YouTube links" (parse_comments) option is enabled and a shortcode uses the liststyle attribute set to "season".
Does exploitation require an attacker to authenticate or interact with a victim first?
No authentication or victim interaction is required to inject the malicious script. The stored script executes when a user later accesses the injected page.
What configuration should be checked during triage?
Check whether the parse_comments option, labeled "Parse Vimeo and YouTube links," is enabled. Also identify pages containing FV Flowplayer shortcodes with liststyle="season", as both conditions are required for the vulnerable code path.
What can be done if updating is not immediately possible?
Disable the "Parse Vimeo and YouTube links" (parse_comments) option and avoid or remove shortcode usage with liststyle="season". Review affected pages for injected script content before re-enabling the option or restoring the shortcode configuration.