CVE-2026-110001

Name of the Vulnerable Software and Affected Versions FV Flowplayer Video Player versions prior to 7.5.55.7213

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. By manipulating the align shortcode attribute within comments, an attacker can inject arbitrary web scripts that execute when users visit the affected page. This issue occurs when an administrator enables the 'Parse Vimeo and YouTube links' (parse comments) setting, which triggers the do shortcode() function on the comment text filter, rendering stored shortcode attributes without proper escaping.

Recommendations Update FV Flowplayer Video Player to a version newer than 7.5.55.7212. Disable the 'Parse Vimeo and YouTube links' (parse comments) setting to prevent the execution of shortcodes in comments.