What is the CVSS score of CVE-2026-12135?

CVE-2026-12135 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

FV Flowplayer Video Player CVE-2026-12135

EUVD-2026-40899 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-01 Wordfence

GHSA-vq2p-p7j9-wrx9

WordPress XSS Fv Flowplayer Video Player Wordpress Plugin Foliovision

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

Network-accessible plugin requiring PR:L contributor auth; S:C reflects XSS scope change to victim browser; A:N as server availability is unaffected.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 05:31 vuln.today

CVE Published

Jul 01, 2026 - 03:43 nvd

MEDIUM 6.4

DescriptionCVE.org

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_player' shortcode 'align' attribute in all versions up to, and including, 7.5.51.7212 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in FV Flowplayer Video Player (all WordPress plugin versions up to and including 7.5.51.7212) allows authenticated contributors to permanently inject arbitrary JavaScript via the unsanitized align attribute of the [video_player] shortcode. The payload persists in the WordPress database and executes in the browser of every user who subsequently visits any page containing the injected shortcode, enabling session hijacking, credential harvesting, or further site compromise. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the stored nature of this XSS amplifies real-world risk relative to reflected variants.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), the canonical stored XSS class. The flaw exists in controller/shortcodes.php within the fv-wordpress-flowplayer plugin (CPE: cpe:2.3:a:foliovision:fv_flowplayer_video_player:*:*:*:*:*:*:*:*), specifically at lines L227 and L293 as referenced in the WordPress Plugin Trac browser. The align attribute of the [video_player] shortcode is passed through to HTML output without sanitization or escaping, allowing raw attacker-controlled content to be rendered as executable script. As a stored XSS variant, the injected payload is written to the WordPress database at injection time and served to every subsequent page visitor, unlike reflected XSS where each victim must be individually lured to a crafted URL. The CVSS Scope:Changed metric (S:C) correctly captures that the script executes in the victim's browser security context, outside the plugin's own domain boundary.

RemediationAI

Administrators should update the FV Flowplayer Video Player plugin to the latest version available in the WordPress plugin repository immediately. A patch has been committed to the plugin trunk (WordPress Trac changeset between revisions 3557974 and 3586305 at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3586305%40fv-wordpress-flowplayer%2Ftrunk&old=3557974%40fv-wordpress-flowplayer%2Ftrunk), however the specific released version number incorporating this fix was not confirmed in the available data - verify the installed version exceeds 7.5.51.7212 after updating. As a compensating control prior to patching, restrict the WordPress contributor role to fully trusted users only and audit existing contributor accounts for unauthorized access, since eliminating untrusted contributor access removes the attack surface entirely without requiring the plugin to be disabled. If the plugin can be temporarily deactivated on sites where video embedding is non-critical, this eliminates the risk surface pending a confirmed patched release. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d5a3a560-08e6-43b7-b953-4e704eafc49b for a confirmed fixed version number.