CVE-2026-85347 in FV Flowplayer Video Player Plugin
Summary
by MITRE • 11/05/2026
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the affected page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in FV Flowplayer Video Player versions prior to 7.5.56.7212 represents a classic Cross-Site Scripting (XSS) flaw rooted in insufficient input validation and output encoding mechanisms within the WordPress plugin architecture. This security defect specifically affects how user-supplied data is handled during the rendering of video player configurations or metadata on public-facing pages. The core technical failure lies in the absence of proper sanitization routines that would strip potentially malicious payloads from incoming parameters, combined with a lack of escaping functions such as esc_html or wp_kses_post before these values are injected into the HTML DOM. Consequently, any data submitted by an authenticated user is rendered directly to the browser without transformation, creating a direct vector for script injection.
From an operational perspective, this vulnerability allows attackers with lower-level privileges, specifically those holding the Contributor role or higher within WordPress, to execute arbitrary JavaScript code in the context of other users' sessions. While Contributors do not have administrative access, they possess sufficient permissions to create posts and media that utilize the Flowplayer shortcode or settings. When a victim user, such as an Administrator or Editor with elevated privileges, views a page containing the maliciously crafted video player configuration, the embedded script executes immediately in their browser environment. This execution occurs within the trust boundary of the WordPress dashboard or frontend interface, granting the attacker significant leverage over the session context of higher-privileged users.
The impact of this vulnerability extends beyond simple defacement or alert boxes. An attacker can exploit this flaw to perform session hijacking by stealing cookies and authentication tokens stored in local storage or via standard HTTP-only cookie mechanisms if not properly secured against script access. Furthermore, the injected scripts can facilitate keylogging, capturing sensitive input data such as passwords or personal information entered into forms on the site. In more sophisticated attack scenarios, the payload could redirect users to phishing sites designed to mimic legitimate WordPress login pages, thereby harvesting credentials for further compromise of the underlying server infrastructure. The ability to execute code in an administrative context effectively bypasses many traditional perimeter defenses because the traffic originates from a trusted domain and user session.
This vulnerability aligns with CWE-79, which classifies Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. It also maps directly to MITRE ATT&CK technique T1059, specifically sub-technique 007 for Command and Scripting Interpretation via JavaScript. The attack vector is classified under Initial Access through Valid Accounts with low privilege requirements, highlighting the risk of role-based access control failures where lower-tier users can influence higher-tier operational states.
Mitigation strategies must prioritize immediate patching to version 7.5.56.7212 or later, as this release addresses the sanitization and escaping deficiencies in the codebase. For organizations unable to update immediately due to compatibility constraints with other plugins or custom themes, a temporary workaround involves restricting the Contributor role's ability to publish content that utilizes Flowplayer shortcodes until an upgrade can be scheduled. Additionally, implementing a Content Security Policy (CSP) header on the web server can significantly mitigate the impact of successful XSS attacks by restricting the sources from which scripts are allowed to load and execute. Regular security audits focusing on input validation patterns across all active plugins are essential to prevent similar vulnerabilities in future deployments.