FV Flowplayer EUVD-2026-100798

Exploitation requires a specific non-default configuration: the plugin's 'Parse Vimeo and YouTube links' (parse_comments) option must be enabled AND a shortcode must use the liststyle attribute set to "season" to reach the vulnerable code path. The injection point is the 'synopsis' shortcode attribute, which lacks input sanitization and output escaping. No authentication is required (PR:N) and no attacker-side user interaction is needed to inject; however, as stored XSS, the payload only fires when a user subsequently visits the injected page. The dual configuration requirement is the primary limiting factor - installations without parse_comments enabled or without a season-style listing are not exploitable despite running an affected version.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 HIGH) describes an unauthenticated, network-reachable stored XSS with a scope change reflecting script execution in the browser of any visitor to an injected page. However, the signals pull in different directions. No EPSS score was supplied, no CISA KEV listing is present, and no public proof-of-concept is referenced, so exploitation probability cannot be quantified and there is no public exploit identified at time of analysis. Crucially, the description contradicts the AC:L rating: exploitation is only reachable when the 'Parse Vimeo and YouTube links' (parse_comments) option is enabled AND the liststyle attribute is set to 'season' - two non-default preconditions that materially raise real-world attack complexity beyond what AC:L implies. This is therefore best treated as a conditional, medium-priority issue rather than a broadly exploitable critical flaw: dangerous where the specific configuration exists, but gated behind a narrow code path on most installations. Verify the parse_comments/liststyle configuration against your deployment before prioritizing.

On a WordPress site running FV Flowplayer Video Player (≤7.5.54.7212) with the 'Parse Vimeo and YouTube links' option enabled and a shortcode using liststyle="season", an unauthenticated attacker supplies a malicious payload in the 'synopsis' shortcode attribute that is stored and rendered without sanitization. When any visitor - including a logged-in administrator - loads the affected page, the injected JavaScript executes in their browser, enabling session/cookie theft or actions on their behalf. No public exploit code is identified at time of analysis.