Security Alert Summary
The FV Player 8 plugin for WordPress is affected by a stored cross-site scripting (XSS) vulnerability via the fv_player_videos parameter. Insufficient input sanitization and output escaping allow authenticated users with subscriber-level access and above to inject scripts that execute when an injected page is viewed. Exploitation requires the administrator-controlled “Allow visitors to upload videos to their profile” setting to be enabled so that the vulnerable save routine is reachable by subscriber-level users.
CVE Details
- CVE ID: CVE-2026-110531
- Affected component: FV Player 8 WordPress plugin
- Affected versions: All versions up to and including 8.1.9
- Published: November 14, 2026 at 4:17:02 PM UTC
- Last modified: November 14, 2026 at 4:17:03 PM UTC
- CVSS v3.1: Base score 6.4, MEDIUM; vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication and privileges: Requires an authenticated user with subscriber-level access or higher. The plugin setting “Allow visitors to upload videos to their profile” must be enabled for subscriber-level users to reach the vulnerable save routine.
- User interaction: None required (UI:N)
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
This is a stored XSS vulnerability caused by insufficient input sanitization and output escaping of the fv_player_videos parameter. Because the plugin saves user-controlled data into pages that are later rendered to other users, an authenticated attacker who can reach the plugin save routine can inject arbitrary web scripts. Those scripts will execute in the browser context of any user who opens a page containing the injected content.
The vulnerability is constrained by two factors noted in the report: an attacker must be authenticated with at least subscriber-level privileges, and the site administrator must have enabled the “Allow visitors to upload videos to their profile” setting so that the vulnerable save routine is accessible to such users. The CVSS vector indicates a network attack vector with low complexity and no user interaction, and that successful exploitation can change the scope of impacted components while producing low confidentiality and integrity impacts and no availability impact.
How This Could Impact Your Website
Consider a site where the owner allows contributors or external users to upload or manage profile videos. An authenticated subscriber or external contributor who can reach the affected save routine could add a crafted video entry that includes a script payload. When internal staff or other site users view the page containing the injected video entry, the script could run in their browsers. Practical consequences include exposure of data accessible in the user browser context, such as internal user email addresses or other information displayed on the page, and an increased risk of targeted phishing or social engineering against staff or contributors.
This does not necessarily imply a full site compromise, but it can undermine user trust and enable further targeted attacks against site users. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Temporarily disable the “Allow visitors to upload videos to their profile” setting if it is not required.
- Review and reduce unnecessary user roles, especially contributor and subscriber privileges.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior related to uploads or profile changes.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://github.com/foliovision/fv-wordpress-flowplayer/commit/1c936e8100989c34e08415adfcb5ea3db2109902
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/freedom-video-player/modules/overlay-popup.module.js#L95
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/custom-videos.php#L115
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/custom-videos.php#L757
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/custom-videos.php#L790
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/email-subscription.php#L762
- https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/fv-player-frontend.php#L1224
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4d581f96-5a30-49f7-bddf-45dd581d7a24?source=cve
