CVE-2026-97630: FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the profilevideosenablebio option to be enabled, as script execution occurs on the author bio/archive page where the profile-video shortcode is rendered.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the profile_videos_enable_bio option to prevent rendering the author bio/archive page where the vulnerable profile-video shortcode is executed.
FV Flowplayer Video Player profile_videos_enable_bio = disabled
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running FV Flowplayer Video Player versions through 7.5.54.7212 are affected when the profile_videos_enable_bio option is enabled. The injected shortcode is rendered on the author bio/archive page.
What level of access does an attacker need?
An attacker needs an authenticated WordPress account with Subscriber-level access or higher. No user interaction is required for injection, but the stored script executes when someone accesses the affected injected page.
What can be done if an update cannot be applied immediately?
Disable the profile_videos_enable_bio option to prevent rendering of the profile-video shortcode on author bio/archive pages. Review content associated with authenticated user profiles for injected popup shortcode attributes before re-enabling the option.