CVE-2026-97398 in FV Flowplayer Video Player Plugin
Summary
by MITRE • 10/15/2026
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' (parse_comments) option to be enabled and the liststyle attribute set to "season" for the vulnerable code path to be reached.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The FV Flowplayer Video Player plugin, a widely utilized tool within the WordPress ecosystem for embedding and managing video content from various sources including Vimeo and YouTube, contains a critical security flaw identified as Stored Cross-Site Scripting (XSS). This vulnerability affects all versions of the plugin up to and including version 7.5.54.7212. The root cause lies in insufficient input sanitization and output escaping mechanisms within the code that handles the synopsis shortcode attribute. When an attacker successfully exploits this flaw, they can inject arbitrary web scripts into pages managed by the WordPress site. These injected scripts are stored on the server-side database rather than being transiently passed via URL parameters or headers, which classifies this as a Stored XSS vulnerability. Consequently, every time a legitimate user accesses a page containing the malicious content, their browser executes the attacker's script in the context of the vulnerable website. This can lead to severe consequences such as session hijacking, credential theft, defacement of the site, or further propagation of malware if the victim has administrative privileges.
The exploitation of this vulnerability is not entirely unrestricted and requires specific configuration conditions on the target WordPress installation to be successfully triggered. Specifically, the attacker must have access to a context where they can inject content into the synopsis field associated with the video player shortcode. Furthermore, two distinct settings within the plugin's administration panel must be configured in particular ways for the vulnerable code path to be reached. First, the option labeled Parse Vimeo and YouTube links, technically referred to as parse_comments, must be enabled. This setting dictates whether the plugin attempts to process and embed videos from external platforms based on comments or specific attributes. Second, the liststyle attribute within the shortcode configuration must be set to season. These constraints mean that while the vulnerability is present in all versions up to 7.5.54.7212, successful exploitation depends on the administrator having enabled these specific features and configured the video player with a seasonal listing style. This specificity highlights the importance of understanding not just the presence of a flaw but also the operational context required for its activation.
From an industry standard perspective, this vulnerability aligns closely with CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting (XSS). The failure to properly sanitize user-supplied input before storage and subsequently escape it during output generation is the classic definition of a stored XSS flaw. In terms of attack vector classification under the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Client-Side Injection, specifically T1059: Command and Scripting Interpreter via browser-based execution. Attackers can leverage this to execute arbitrary JavaScript code within the victim's browser environment. The impact extends beyond simple script execution; it compromises the integrity of the web application by allowing unauthorized modification of page content and potentially stealing sensitive information such as cookies, session tokens, or authentication credentials stored in local storage. For sites with multiple contributors or public comment sections that feed into these video player shortcodes, the risk is amplified because any user with write access to those specific fields can become an initial vector for compromise.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The most effective solution is to upgrade the FV Flowplayer Video Player plugin to a version newer than 7.5.54.7212, where developers have presumably implemented proper input validation and output encoding functions such as wp_kses or esc_html in PHP. For organizations unable to immediately patch due to compatibility concerns with other plugins or custom code modifications, temporary mitigations should be considered. This includes disabling the parse_comments option if Vimeo and YouTube link parsing is not strictly necessary for the site's functionality. Additionally, restricting access to the specific shortcode attributes that trigger this vulnerability can reduce the attack surface. Implementing a Web Application Firewall (WAF) with rules tuned to detect XSS payloads in POST requests targeting WordPress content fields can provide an additional layer of defense by blocking malicious inputs before they are stored in the database. Regular security audits and code reviews focusing on input sanitization practices across all custom plugins and themes are essential to prevent similar vulnerabilities from being introduced or overlooked in future updates.