CVE-2026-95807

Name of the Vulnerable Software and Affected Versions FV Player 8 versions prior to 8.1.8

Description Insufficient input sanitization and output escaping allow for Stored Cross-Site Scripting. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. Additionally, unauthenticated visitors can exploit this issue if the parse comments setting (Parse Vimeo and YouTube links) is enabled, which allows the plugin to process shortcodes within comment text. The issue occurs via the synopsis shortcode attribute.

Recommendations Update to version 8.1.8 or later. Disable the parse comments setting to prevent unauthenticated exploitation.