CVE-2026-97398

Name of the Vulnerable Software and Affected Versions FV Flowplayer Video Player versions prior to 7.5.54.7213

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. This occurs via the synopsis shortcode attribute. The attack is successful when the parse comments option (Parse Vimeo and YouTube links) is enabled and the liststyle attribute is set to "season".

Recommendations Update to a version newer than 7.5.54.7212. Disable the parse comments option or avoid setting the liststyle attribute to "season" as a temporary mitigation.