CVE-2026-42695 in FV Flowplayer Video Player Plugin
Summary
by MITRE • 10/09/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.54.7212.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The identified security flaw represents a classic instance of Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or XSS. Specifically, this vulnerability manifests as a Stored XSS within the FolioVision FV Flowplayer Video Player plugin for WordPress, affecting versions ranging from initial releases up through version 7.5.54.7212. Unlike reflected XSS attacks where malicious scripts are executed immediately via a crafted link, stored vulnerabilities persist on the target server because the injected payload is saved in the application's database or file system. This means that every time an affected page containing the compromised content is loaded by any user, including administrators and regular visitors, the malicious script executes within their browser context. The root cause lies in the insufficient sanitization of input fields provided to the plugin, allowing attackers to inject executable JavaScript code into video player configurations or metadata without proper validation against a strict allowlist of safe characters and tags.
From an operational perspective, this vulnerability poses significant risks to both website owners and end-users. For site administrators, successful exploitation can lead to complete account compromise if session cookies are stolen via scripts like document.cookie exfiltration techniques. Attackers can hijack administrative sessions, leading to unauthorized content modification, defacement of the website, or further pivoting into deeper network infrastructure depending on the privileges associated with the compromised admin account. For regular users visiting pages that contain the stored malicious payload, the impact includes potential redirection to phishing sites, installation of malware through drive-by downloads if combined with other exploits, and theft of sensitive personal information such as login credentials or financial data entered during browsing sessions. The persistent nature of this flaw ensures a wide attack surface since the payload remains active until manually removed from the database by an administrator who may not be aware of its presence.
In terms of industry standard classification, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation Cross-site Scripting in the Common Weakness Enumeration framework. It also maps to specific tactics within the MITRE ATT&CK matrix for web applications, particularly T1059 Command and Scripting Interpreter where JavaScript is used as a vehicle for execution, and potentially T1271 Browser Session Hijacking if session tokens are targeted. The lack of output encoding or input validation allows arbitrary code injection which violates fundamental principles of secure coding practices regarding the separation of data and executable code within web applications.
To mitigate this risk, immediate action is required to update the FolioVision FV Flowplayer Video Player plugin to a patched version that addresses these sanitization gaps. If updating is not immediately feasible due to compatibility constraints with other site components, temporary workarounds should be implemented at the Web Application Firewall level to filter out common XSS payloads such as script tags and event handlers in HTTP requests targeting the affected endpoints. Additionally, implementing Content Security Policy headers can help mitigate the impact of any successful injection by restricting the sources from which scripts are allowed to execute. Regular security audits and code reviews focusing on input validation mechanisms for all user-facing inputs within WordPress plugins are essential preventive measures against similar vulnerabilities in the future.