CVE-2026-117525highCWE-79

CVE-2026-117525: high-severity vulnerability in FV Flowplayer Video Player

FV Player < 7.5.57.7212 - Unauthenticated Stored XSS via Comment Popup

Published

Follow this CVE+ Monitor FV Flowplayer Video Player

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 7.5epss 0.3%
The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded in comments before rendering them into the media player markup, allowing an unauthenticated visitor to store a script payload in a comment that executes in the session of any visitor, including an administrator, who plays the commented video, when the non-default comment-shortcode-parsing setting is enabled.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Unknown · FV Flowplayer Video Player
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — FV Flowplayer Video Player

In the same product, most dangerous first.

CVE-2026-85347MEDIUMFV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox CaptionEPSS 0.2%CVE-2026-85345MEDIUMFV Player 7.5.44.7212 - 7.5.54.7212 - Contributor+ SSRF via retrieve_video_dataEPSS 0.2%CVE-2026-108068LOWFV Flowplayer Video Player 7.4.44.727 - 7.5.55.7212 - Contributor+ Bulk Video Record Disclosure and Modification via Migration WizardEPSS 0.2%CVE-2026-108067LOWFV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDOREPSS 0.2%CVE-2026-85351MEDIUMFV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library ImportEPSS 0.2%CVE-2026-85344MEDIUMFV Player < 7.5.57.7212 - Subscriber+ Bulk Post Modification via Missing AuthorizationEPSS 0.2%