CVE-2026-110533 in FV Flowplayer Video Player Plugin
Summary
by MITRE • 10/30/2026
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos[_fv_player_user_video][]' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have enabled the "Allow visitors to upload videos to their profile" (profile_videos_enable_bio) setting before Subscriber-level users can submit profile videos.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The FV Flowplayer Video Player plugin for WordPress, specifically in versions up through 7.5.55.7212, contains a critical stored cross-site scripting vulnerability within the fv_player_videos[_fv_player_user_video][] parameter. This flaw stems from insufficient input sanitization and output escaping mechanisms when processing user-submitted video data. The vulnerability allows malicious actors to inject arbitrary web scripts into pages that are subsequently served to other users. When these victims access the compromised page, the injected script executes within their browser context, potentially leading to session hijacking, credential theft, or defacement of the website interface.
The exploitation of this vulnerability requires a specific set of conditions and user privileges. An attacker must possess authenticated access with at least subscriber-level permissions on the WordPress site. Furthermore, the administrator must have explicitly enabled the profile_videos_enable_bio setting, which permits visitors to upload videos to their profiles. This configuration requirement means that while the flaw exists in all versions up to 7.5.55.7212, it is only exploitable when this specific feature is active. Once these conditions are met, an attacker can craft a malicious video file or metadata payload containing JavaScript code. Upon upload and subsequent viewing by other users, such as administrators or regular subscribers, the script executes in their browser environment.
From a technical classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). The stored nature of the attack means that the malicious payload is saved on the target server and executed every time a victim views the affected content. This persistence distinguishes it from reflected XSS attacks, where the script is only executed once during the immediate request. In terms of threat modeling, this behavior corresponds to ATT&CK technique T1059.007, which covers JavaScript execution within web browsers. The ability for lower-privileged users like subscribers to inject code that affects higher-privileged users or other visitors represents a significant escalation path and violates the principle of least privilege in terms of data integrity and user experience security.
The operational impact of this vulnerability is severe due to its stored nature. Unlike reflected XSS, which requires social engineering to trick a specific victim into clicking a malicious link, stored XSS persists on the server side. This means that every new visitor or administrator who views the profile with the injected video becomes a potential victim without any additional interaction from the attacker. The consequences can include unauthorized access to user accounts if session cookies are stolen via document.cookie extraction, redirection of users to phishing sites, or manipulation of page content to display misleading information. In enterprise environments, this could lead to broader compromise if administrators interact with compromised pages and their credentials are subsequently harvested.
Mitigation strategies should focus on immediate remediation and long-term security hardening. The primary recommendation is to upgrade the FV Flowplayer Video Player plugin to a version later than 7.5.55.7212, where this input validation issue has been addressed by the developers. If upgrading is not immediately feasible, administrators should disable the profile_videos_enable_bio setting to prevent users from uploading videos that could carry malicious payloads. Additionally, implementing strict Content Security Policy headers can help mitigate the impact of any successful XSS attempts by restricting script execution sources. Regular security audits and code reviews focusing on input sanitization and output escaping are essential for preventing similar vulnerabilities in WordPress plugins and web applications generally. Developers must ensure that all user-supplied data is validated against expected formats and encoded appropriately before being rendered in HTML contexts to prevent injection attacks.