CVE-2026-121515

Name of the Vulnerable Software and Affected Versions FV Flowplayer Video Player versions prior to 7.5.56.722

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the comment parameter. Exploitation requires the 'Parse Vimeo and YouTube links' option to be enabled and the injected comment to be approved by an administrator before the script executes for visitors.

Recommendations Update FV Flowplayer Video Player to a version newer than 7.5.56.7212. Disable the 'Parse Vimeo and YouTube links' option as a temporary mitigation measure.