FV Flowplayer EUVD-2026-95915

Exploitation requires an attacker to hold a WordPress account with sufficient privileges to submit/store content through the FV Flowplayer Video Player plugin (per CVSS PR:L), and requires a second user - typically a higher-privileged admin or editor - to subsequently view the page or admin view where the stored payload renders (per UI:R). The affected products are all FV Flowplayer Video Player versions from an unspecified start through 7.5.54.7212. Limiting factors that reduce real-world risk: the attacker cannot be fully anonymous (no PR:N), the payload does not execute until a victim loads the content, and impact is confined to the browser context of whoever views the malicious content rather than direct server compromise. The exact input field serving as the injection vector is not specified in the available description.

This is a moderate-severity Stored XSS (CWE-79) in the FolioVision FV Flowplayer Video Player WordPress plugin, rated CVSS 6.5. The provided CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) indicates network-reachable, low-complexity exploitation that nonetheless requires some level of existing privileges (PR:L) to inject the stored payload and victim interaction (UI:R) to trigger it - classic for a stored XSS where a lower-privileged contributor/author injects script that executes when a higher-privileged user (e.g. an admin) renders the affected page. The scope change (S:C) reflects that code executes in the victim's browser context beyond the vulnerable component. On exploitation signals: there is no CISA KEV listing and no EPSS score supplied in the input, and no public exploit is referenced, so active-exploitation and widespread-weaponization indicators are absent. The single source is a Patchstack database entry (the vendor/researcher who reported it), which confirms the vulnerability and affected version range but does not itself establish in-the-wild use. Overall this is a real but not top-priority issue: it depends on an attacker already holding a privileged-enough account AND a victim viewing the malicious content, which materially lowers real-world urgency compared to an unauthenticated RCE. Note one consistency caveat: the input CVSS already encodes PR:L (authenticated), but no vendor advisory beyond Patchstack is available to independently confirm the exact privilege level required - verify against the plugin's changelog.

A registered low-privilege user (such as a contributor or author) submits video-player content containing a crafted script payload that the plugin stores without proper output neutralization. When an administrator or other user later views the page or admin screen rendering that content, the script executes in their authenticated browser session, enabling session/cookie theft or actions performed as the victim. No public proof-of-concept exploit was referenced in the available data; exploitation requires both an attacker-held account and victim interaction per the AV:N/AC:L/PR:L/UI:R vector.