CVE-2026-110533

Name of the Vulnerable Software and Affected Versions FV Flowplayer Video Player versions prior to 7.5.55.7212

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This occurs via the fv player videos[ fv player user video][] parameter, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users. This issue is exploitable if an administrator has enabled the "Allow visitors to upload videos to their profile" (profile videos enable bio) setting.

Recommendations Update to a version newer than 7.5.55.7212. Disable the profile videos enable bio setting to prevent subscriber-level users from submitting profile videos.