FV Flowplayer CVE-2026-110001

Exploitation requires the administrator to have enabled the plugin's 'Parse Vimeo and YouTube links' (parse_comments) setting, which registers do_shortcode on the comment_text filter and causes attacker-supplied shortcode attributes stored in comments to be processed; this is the exact gating condition and it is not the default. It also requires that the site accept comments (the input path for unauthenticated attackers) and that a user subsequently view the page containing the injected comment for the script to fire. Limiting factors: if parse_comments is disabled (default), comment text is not shortcode-processed and the flaw is not reachable; impact is confined to client-side script execution in visitors' browsers (C:L/I:L, no availability impact) on the vulnerable plugin versions <= 7.5.55.7212.

This is a medium-severity stored XSS (CVSS 5.4, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) whose real-world priority is tempered by a hard configuration precondition. The signals are mostly consistent rather than conflicting: AV:N/PR:N reflect that an unauthenticated attacker can inject via a comment, S:C reflects that the stored script executes in the context of other users/pages, and AC:H reflects the dependency on a non-default setting. The vuln.today decision label is 'this_month' (not act_now/emergency), and there is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or widespread exploitation. No public exploit is identified in the supplied references - they are a Wordfence advisory, plugin source lines, and the fix commit, none of which is verified working exploit code. Data gaps to note explicitly: EPSS probability is MISSING and KEV status is absent (treat as not-listed), so quantitative exploitation likelihood cannot be derived; the concrete fixed release version number is not stated in the input (only the fixing commit is provided). Net assessment: a genuine but conditional stored-XSS issue that warrants patching on a normal maintenance cadence rather than emergency response, because exploitation requires the administrator to have enabled a non-default comment-parsing feature.

On a WordPress site running FV Flowplayer Video Player (<= 7.5.55.7212) where an administrator has enabled the 'Parse Vimeo and YouTube links' (parse_comments) setting, an unauthenticated attacker submits a comment containing the plugin's shortcode with a malicious 'align' attribute. Because do_shortcode is applied to comment_text and the 'align'/lightbox_align value is rendered without sanitization or output escaping, the injected script is stored and then executes in the browser of every subsequent visitor who views that page. No public exploit is identified at time of analysis, and the high attack complexity (AC:H) stems from the required non-default configuration rather than from a difficult trigger.