Foliovision FV Flowplayer Video Player stored XSS flaw listed in EUVD-2026-114223
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Foliovision
- Product
- FV Flowplayer Video Player
- First seen
Summary
The EUVD listing (CVSS v3.1 score 6.4) describes a stored cross-site scripting flaw in the FV Flowplayer Video Player WordPress plugin, affecting all versions up to and including 7.5.55.7212. The listing does not name a CVE ID and the item does not indicate that a fix is available.
If you use Foliovision
Check whether the FV Flowplayer Video Player plugin is installed on your WordPress sites and which version
Update to a patched release from Foliovision once it is confirmed
Review user-submitted video content for suspicious script injection
Update FV Flowplayer Video Player to a version newer than 7.5.55.7212
Check the EUVD entry for patch status
Restrict editor and contributor accounts that can add shortcodes until patched
What the sources say 4
· Mastodon: “The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos[_fv_player_user_video][]' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient inpu...” Source
· Mastodon: “The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping” Source
· Mastodon: “The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment (shortcode attribute 'align')' parameter in all versions up to, and including, 7.5.55.7212” Source
· Mastodon: “Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions.” Source