What is the CVSS score of CVE-2026-49773?

CVE-2026-49773 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-49773?

Yes, a patch is available for CVE-2026-49773. Update the affected software to the latest version immediately.

FV Flowplayer Video Player CVE-2026-49773

Q: Which versions of FV Flowplayer Video Player are affected by CVE-2026-49773?

Stored Cross-Site Scripting in the FV Flowplayer Video Player WordPress plugin (versions below 7.5.51.7212) allows low-privileged authenticated users - specifically those with subscriber-level access…. A patch is available.

EUVD-2026-36894 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-15 Patchstack

GHSA-5m6c-89c7-62pm

XSS Fv Flowplayer Video Player

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

PR:L reflects subscriber-level access requirement; UI:R for victim page load; S:C for cross-session XSS; A:N because XSS does not cause service availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:50 vuln.today

Patch available

Jun 15, 2026 - 22:02 EUVD

DescriptionCVE.org

Subscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions.

AnalysisAI

Stored Cross-Site Scripting in the FV Flowplayer Video Player WordPress plugin (versions below 7.5.51.7212) allows low-privileged authenticated users - specifically those with subscriber-level access - to inject persistent malicious JavaScript that executes in the browsers of other site visitors or administrators who view affected content. The Scope:Changed CVSS metric confirms the payload escapes the plugin's trust boundary and can target higher-privileged sessions. No public exploit identified at time of analysis, and SSVC signals no confirmed exploitation; a vendor-released patch is available at version 7.5.51.7212.

Technical ContextAI

The affected component is the FV Flowplayer Video Player plugin for WordPress, developed by Foliovision and identified via CPE cpe:2.3:a:foliovision:fv_flowplayer_video_player:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning the plugin fails to properly sanitize or escape user-supplied input before rendering it in HTML/JavaScript context. The 'Subscriber' qualifier in the CVE title indicates the vulnerable input surface is accessible to the lowest authenticated WordPress role (subscriber), requiring no administrator or editor privileges to plant the payload. The CVSS S:C (Scope Changed) metric reflects the classic stored XSS cross-boundary issue: code injected by one user executes in another user's browser session, potentially targeting admin cookies or performing privileged actions.

RemediationAI

The primary remediation is to update the FV Flowplayer Video Player plugin to version 7.5.51.7212 or later via the WordPress plugin dashboard or manual update from the plugin repository; this is a vendor-released patch per advisory EUVD-2026-36894. If immediate update is not feasible, restrict subscriber-level user registration on the WordPress site (Settings → General → uncheck 'Anyone can register') to deny unauthenticated visitors the ability to create accounts and reach the vulnerable input surface - note this may affect legitimate membership workflows. Additionally, a Web Application Firewall (WAF) with XSS filtering rules can serve as a compensating control to detect and block script injection attempts in plugin input fields, though WAF bypass is possible and this is not a substitute for patching. Site administrators should also audit recent subscriber accounts for any existing injected content in video player configuration fields.