FV Flowplayer CVE-2026-109984

Exploitation requires a specific non-default configuration and a privileged human action, which together strongly limit realistic risk: (1) the 'Parse Vimeo and YouTube links' option must be enabled in the FV Flowplayer settings; (2) the attacker-submitted comment contains a crafted [fvplayer] or [flowplayer] shortcode whose 'ad', 'popup', or 'end_action_value' attribute holds malicious HTML, with whitespace smuggled as HTML entities to survive attribute parsing; (3) a site administrator must manually approve/publish that comment; and (4) payload execution only fires for a visitor who actively interacts with the video player on the affected page. The attacker needs no account (guest commenter), but the mandatory admin-approval step and non-default setting are the dominant limiting factors beyond the raw CVSS score.

Signals point to a genuine but moderate-priority issue rather than an urgent one. The CVSS 3.1 base score is 5.4 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N - network-reachable and nominally unauthenticated (PR:N), but with high attack complexity. Critically, PR:N captures only that the comment-submitting attacker needs no account; it does NOT capture the description's hard gating conditions, which materially lower real-world risk: the non-default 'Parse Vimeo and YouTube links' option must be enabled AND a site administrator must manually approve the malicious comment before any payload can be stored. This is a conflict worth flagging explicitly - the 'unauthenticated' framing overstates practical exploitability because a human admin approval step sits in the attack path. No EPSS score was provided in the input, so statistical exploitation likelihood cannot be weighed. There is no CISA KEV listing and no confirmed public exploit code; the only code artifacts are the vendor fix commit and plugin source references, not weaponized PoCs. The vuln.today decision label is 'this_month' (routine patch cadence), not act_now or emergency, which is consistent with the multiple preconditions and partial (C:L/I:L) impact. On an SSVC-style read: technical impact is partial, and the attack is not automatable because it depends on a non-default setting plus manual admin approval. Net: a real, patch-worthy stored XSS, but closer to a targeted/opportunistic low-to-moderate risk than a widespread emergency.

On a site running FV Flowplayer with the 'Parse Vimeo and YouTube links' option enabled, an unauthenticated visitor submits a blog comment containing a crafted [fvplayer]/[flowplayer] shortcode whose 'ad', 'popup', or 'end_action_value' attribute carries HTML/script, smuggling spaces as HTML entities to evade filtering. Because the AC:H conditions require the attacker to clear a manual gate, a site administrator must approve that comment; once approved, the attribute value is html_entity_decode()'d and emitted as raw HTML, so the script executes in the browser of any visitor who interacts with the video player on that page. No confirmed public exploit code is identified at time of analysis - only the vendor's fix commit is public.