CVE-2026-97630 in FV Flowplayer Video Player Plugin
Summary
by MITRE • 10/10/2026
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the profile_videos_enable_bio option to be enabled, as script execution occurs on the author bio/archive page where the profile-video shortcode is rendered.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/10/2026
The FV Flowplayer Video Player plugin for WordPress contains a critical security vulnerability affecting all versions up through 7.5.54.7212. This flaw manifests as a Stored Cross-Site Scripting issue, specifically triggered by an unquoted popup shortcode attribute that lacks sufficient input sanitization and output escaping mechanisms. The nature of this vulnerability allows malicious actors to inject arbitrary web scripts into the application's content storage, which are then persistently served to users upon request rather than being executed solely within a single session context.
Successful exploitation of this flaw requires specific conditions regarding user privileges and plugin configuration. An attacker must possess authenticated access with at least subscriber-level permissions or higher to interact with the relevant administrative features. Furthermore, the vulnerability is contingent on the profile_videos_enable_bio option being enabled within the WordPress environment. This setting dictates whether the author bio section displays video content via shortcodes, thereby creating the necessary execution context for the malicious payload.
The operational impact of this vulnerability centers on the compromise of user sessions and data integrity through script injection in the author bio or archive pages. When a victim with valid credentials accesses a page containing the injected shortcode, the browser interprets the embedded JavaScript as part of the legitimate page content. This execution environment allows attackers to perform actions such as stealing session cookies, hijacking administrative accounts, defacing websites, or redirecting users to malicious external sites. The persistence of stored XSS means that every user viewing the compromised author bio is exposed to the attack vector without needing direct interaction with the attacker's initial payload entry point.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involving unquoted attributes in HTML contexts often relates to improper parsing rules that allow script injection through attribute value manipulation. In terms of the MITRE ATT&CK framework for enterprise security, this behavior corresponds to techniques under the Execution and Collection tactics, particularly those involving client-side code execution such as Client-Side Scripting or Web Shell deployment via stored payloads.
Mitigation strategies should prioritize immediate patching by upgrading the FV Flowplayer Video Player plugin to a version that addresses these sanitization gaps. Administrators who cannot immediately upgrade should consider disabling the profile_videos_enable_bio option if video integration in author bios is not strictly required, thereby removing the attack surface entirely. Additionally, implementing strict Content Security Policy headers can help mitigate the impact of successful XSS attempts by restricting script execution sources and preventing unauthorized inline scripts from running even if they are injected into the DOM. Regular security audits focusing on input validation and output encoding practices for all shortcode attributes within WordPress plugins are recommended to prevent similar vulnerabilities in future updates or other third-party extensions.