Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.new Create a CVE report
Check your stack
CVE-2026-110533medium6.4

FV Flowplayer Video Player <= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes

Impact

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos[_fv_player_user_video][]' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have enabled the "Allow visitors to upload videos to their profile" (profile_videos_enable_bio)…

Source excerpt · Wordfence
Applies when

This requires an administrator to have enabled the "Allow visitors to upload videos to their profile" (profile_videos_enable_bio) setting before Subscriber-level users can submit profile videos.

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

foliovision · Wordfence

FV Flowplayer Video Player

1 range
Wordfence version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

0 → through 7.5.55.7212

semver versions

unaffected

unknown

Other versions: unaffected

Original source description

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos[_fv_player_user_video][]' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have enabled the "Allow visitors to upload videos to their profile" (profile_videos_enable_bio) setting before Subscriber-level users can submit profile videos.

Inside the record

Evidence available

Package identity · not supplied
Version evidence
Remediation guidance · not supplied
Weakness classification
Additional publishers

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-110533

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-79 ↗

CWE-79 Improper Neutralization of Input During Web Page Generation

Wordfence

Related →
Contributing organizations · 2
Wordfence

Assigning organization

2026-10-30
CISA-ADP

Additional data publisher

2026-10-30

What changed

Follow changes
No substantive changes have been recorded here yet. History starts when cve.new observes a change after tracking is enabled; earlier edits are not reconstructed.

Large field values are marked as truncated previews. Original source snapshots remain retained.

References

8 sources
www.wordfence.com/threat-intel/vulnerabilities/id/a24acd18-c94d-4fde-bf6c-7f6b839336d1
Security advisoryWordfence
plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/flowplayer/modules/ad-popup.module.js
Source referenceWordfence
plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/models/custom-videos.php
Source referenceWordfence
plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/models/custom-videos.php
Source referenceWordfence
plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/models/flowplayer-frontend.php
Source referenceWordfence
plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/models/email-subscription.php
Source referenceWordfence
View 2 more references
plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/models/custom-videos.php
Source referenceWordfence
github.com/foliovision/fv-wordpress-flowplayer/commit/7ea0b1bcbedcfc26b43a4b41a32e51c9f81b4332
PatchWordfence