FV Player 8 CVE-2026-95807

Primary path requires an authenticated account with contributor-level privileges or higher (PR:L) that can create/edit content containing the FV Player shortcode, then inject script through the 'synopsis' shortcode attribute due to insufficient sanitization/output escaping. The payload fires when any user views the injected page - no additional user interaction beyond normal page viewing is needed. A secondary, more dangerous path allows UNauthenticated visitors to exploit it ONLY when the plugin's non-default 'Parse Vimeo and YouTube links' (parse_comments) setting is enabled, because that setting causes shortcodes inside comment text to be processed. Limiting factors: the default authenticated path is gated behind contributor access (irrelevant on sites with no untrusted content authors), and the unauthenticated path is gated behind a specific non-default configuration toggle; all versions through 8.1.7 are affected and 8.1.8 remediates it.

This is a moderate-severity Stored XSS (CWE-79) with CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). The scope change (S:C) and network vector are the aggravating factors: injected script executes in the browsers of other users, including administrators, enabling session/account compromise. However, the privileges-required metric (PR:L) correctly reflects that the primary path needs authenticated contributor-level access, which meaningfully limits the attacker pool on well-managed sites. No EPSS score, KEV listing, or public exploit is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is a patch-hygiene priority, not an emergency. One important nuance the base CVSS does NOT capture: the description identifies a secondary UNauthenticated vector when the non-default 'Parse Vimeo and YouTube links' (parse_comments) setting is enabled, which would effectively be PR:N and substantially higher risk. Sites running that configuration should treat this as high priority; default-configured sites face only the contributor-gated path. Patch availability is confirmed (8.1.8), which lowers residual risk for anyone able to update.

An attacker with a contributor account on the WordPress site embeds a malicious FV Player shortcode whose 'synopsis' attribute contains an XSS payload; when an editor or administrator previews or opens the resulting page, the script executes in their authenticated session and can steal cookies or perform admin actions. On sites where the 'Parse Vimeo and YouTube links' (parse_comments) setting is enabled, an unauthenticated visitor can achieve the same by posting the shortcode inside a comment. No public exploit code is identified in the provided data.