CVE-2026-85347: vulnerability in FV Flowplayer Video Player
FV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox Caption
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
0Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Track
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the affected page.
Affected products
Unknown · FV Flowplayer Video PlayerRelated CVEs — FV Flowplayer Video Player
In the same product, most dangerous first.
CVE-2026-85345MEDIUMFV Player 7.5.44.7212 - 7.5.54.7212 - Contributor+ SSRF via retrieve_video_dataEPSS 0.2%CVE-2026-108068LOWFV Flowplayer Video Player 7.4.44.727 - 7.5.55.7212 - Contributor+ Bulk Video Record Disclosure and Modification via Migration WizardEPSS 0.1%CVE-2026-108067LOWFV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDOREPSS 0.1%CVE-2026-85351—FV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library ImportEPSS —CVE-2026-85346—FV Player < 7.5.56.7212 - Subscriber+ Cloud Storage File Disclosure via Media Browser HandlersEPSS —