What is the CVSS score of EUVD-2026-35292?

EUVD-2026-35292 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of FV Flowplayer Video Player are affected by EUVD-2026-35292?

The FV Flowplayer Video Player WordPress plugin (versions through 7.5.49.7212) contains a stored cross-site scripting vulnerability enabling attackers to inject persistent malicious code into website…

How to fix or mitigate EUVD-2026-35292?

24 hours: Verify plugin installation and check whether 'Parse Vimeo and YouTube links' setting is enabled; review recent comment activity for suspicious content. 7 days: Disable the parse_comments option in plugin settings or deactivate the plugin entirely. 30 days: Monitor vendor advisories for patch availability; evaluate replacement video player solutions; if plugin remains active, implement Web Application Firewall rules to block script injection patterns in comment submissions.

FV Flowplayer Video Player EUVD-2026-35292

| CVE-2026-7556 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 security@wordfence.com

GHSA-qpcq-fxp5-fvp9

XSS WordPress

7.2

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from Vendor (wordfence) · only source for this CVE.

CVSS VectorVendor: wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 03:32 vuln.today

CVE Published

Jun 09, 2026 - 03:16 nvd

HIGH 7.2

DescriptionCVE.org

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment text in all versions up to, and including, 7.5.49.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have enabled the non-default 'Parse Vimeo and YouTube links' (parse_comments) plugin setting, and requires a submitted comment to be approved by an administrator before the payload is publicly delivered.

Articles & Coverage 2

News 4 New WordPress Vulnerabilities - 4 High Severity Jun 10, 2026 News 4 New WordPress Vulnerabilities - 4 High Severity Jun 09, 2026

AnalysisAI

Stored cross-site scripting in the FV Flowplayer Video Player WordPress plugin (versions through 7.5.49.7212) allows remote attackers to inject persistent JavaScript via the comment text field, which executes in any visitor's browser when the affected page is loaded. The flaw stems from insufficient input sanitization and output escaping in the comment-parsing routine and is reachable only when the non-default 'Parse Vimeo and YouTube links' (parse_comments) option is enabled and an administrator approves the malicious comment. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The affected component is the WordPress comment-rendering pipeline of the FV Flowplayer Video Player plugin, specifically the frontend controller (controller/frontend.php around lines 657 and 685, per the WordPress.org Trac references). When the parse_comments setting is enabled, the plugin scans comment bodies for Vimeo and YouTube URLs to convert them into embedded players, but the routine fails to fully sanitize untrusted input or escape it on output. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) issue: attacker-controlled text from the comment field is reflected into the rendered page as HTML/JavaScript context without adequate encoding, so script payloads delivered via crafted comment content persist in the database and execute on every subsequent page view.

RemediationAI

Upgrade the FV Flowplayer Video Player plugin to a release later than 7.5.49.7212; the Trac changeset referenced in the advisory (https://plugins.trac.wordpress.org/changeset?new=3522496%40fv-wordpress-flowplayer%2Ftrunk&old=3478883%40fv-wordpress-flowplayer%2Ftrunk) shows the upstream fix, but a specific tagged patched version is not independently confirmed from the supplied data, so verify the latest version on the WordPress.org plugin page before upgrading. As an immediate workaround on sites that cannot upgrade, disable the 'Parse Vimeo and YouTube links' (parse_comments) setting in the plugin configuration - this fully removes the attack surface at the cost of losing automatic Vimeo/YouTube link embedding in comments. Additionally, tighten comment moderation policy so administrators do not approve comments containing unusual HTML, URL-encoded payloads, or unknown video links until patched, and consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/8bcd5259-2e35-41f6-b269-5b679e4eaab9 for vendor guidance.