FV Flowplayer Video Player CVE-2026-49773

Exploitation requires the attacker to hold a valid subscriber-level (or higher) WordPress account on the target installation, meaning user registration must be open or the attacker must have obtained credentials through other means. The vulnerable input is exposed through the FV Flowplayer Video Player plugin's subscriber-accessible fields, so the plugin must be active and installed on the site. Exploitation is further limited by the UI:R requirement: a separate victim (typically a privileged user such as an editor or administrator) must navigate to a page rendering the injected content for the payload to execute. WordPress sites with user registration disabled, or those that restrict subscriber access to plugin configuration, substantially reduce real-world exposure beyond what the raw CVSS score implies.

The provided CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) is broadly consistent with a stored subscriber-triggered XSS in a WordPress plugin. Low attack complexity and network attack vector lower the bar once an attacker has a subscriber account, but user interaction (UI:R) is required - a victim must load the page containing the injected payload. The A:L (availability) metric in the provided vector is atypical for XSS and may be inflated; availability impact from XSS is generally browser-session-scoped rather than service-disrupting. SSVC assessment confirms exploitation status as 'none' and automatable as 'no,' indicating no evidence of active or scripted exploitation. The vulnerability is not listed in CISA KEV. Real-world risk is moderate: WordPress plugins with subscriber-level stored XSS are attractive for privilege escalation campaigns (inject payload → wait for admin to view → steal session), but require registration capability to be enabled on the target site. Sites with closed registration are at significantly lower risk. No EPSS score was provided; without it, exploitation probability cannot be quantitatively compared.

An attacker registers a subscriber account on a WordPress site running a vulnerable version of FV Flowplayer Video Player and injects a malicious JavaScript payload into a plugin-controlled field - such as a video shortcode attribute or player configuration option. When a site administrator or editor later views a page containing the affected video player instance, the script executes in their browser, potentially exfiltrating the admin session cookie or performing unauthorized actions such as creating a new administrator account on behalf of the attacker. No public proof-of-concept has been identified at the time of this analysis.