FV Flowplayer Video Player CVE-2026-110533

Two prerequisites must both hold: (1) an administrator must have enabled the 'Allow visitors to upload videos to their profile' (profile_videos_enable_bio) setting, which is non-default; and (2) the attacker must hold an authenticated account at subscriber level or above (CVSS PR:L). Given those, the attacker submits a profile video whose attribute value (per the patch, end_popup_preview - alongside ad, popup, end_action_value) is emitted as raw HTML by the player, with end_popup_preview specifically rendering on page load. Limiting factors: the non-default admin configuration gate, the authentication requirement, and that the stored payload only fires when a user accesses the injected page.

This is a medium-severity stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) with signals that consistently point to routine rather than urgent priority. The SSVC framework reports Exploitation: none, Automatable: no, and Technical Impact: partial, and vuln.today assigns a 'this_month' decision label - not act_now or emergency. There is no CISA KEV listing and no EPSS score was supplied, so widespread or automated exploitation is not indicated. The CVSS vector shows PR:L, so exploitation is authenticated (subscriber-level), and the scope change (S:C) reflects script execution crossing into victim browsers, which is why impact is scored C:L/I:L rather than higher. Critically, the description states a non-default precondition: an administrator must first enable the 'Allow visitors to upload videos to their profile' (profile_videos_enable_bio) setting before subscriber users can submit profile videos - this materially reduces the real-world attack surface below what the AV:N/AC:L vector alone suggests. Net assessment: a genuine but contained issue warranting scheduled patching, not an emergency; EPSS was not provided, so exploitation probability could not be quantified from the input.

On a site where an administrator has enabled visitor profile-video uploads, an attacker who registers or holds a subscriber-level account submits a profile video containing a malicious attribute (such as end_popup_preview) whose value the player outputs as raw HTML on page load. When any user - including an administrator - subsequently views the injected profile page, the attacker's script executes in their browser session. No public exploit code was identified in the provided input; the referenced links are the Wordfence advisory, plugin source lines, and the vendor patch commit.