FV Flowplayer EUVD-2026-96059

Exploitation requires (1) an authenticated account with subscriber-level privileges or higher on the target WordPress site, and (2) the profile_videos_enable_bio option to be enabled, because the injected profile-video shortcode is only rendered - and the script only executes - on the author bio/archive page. Both are limiting factors: the bio feature is a non-default configuration, and sites that disable open user registration remove the practical path to obtaining the required subscriber account. Execution is triggered when any user subsequently views the affected author archive page.

This is a moderate-severity stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) that should be treated as a patch-in-normal-cycle item rather than an emergency. The network attack vector and low complexity are offset by two meaningful constraints: the attacker must already hold an authenticated account (PR:L, subscriber-level) and the site must have the non-default profile_videos_enable_bio option enabled. No EPSS score was supplied in the input, so exploitation probability cannot be quantified; the CVE is not listed in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The description's requirement that execution occurs only on a rendered author bio/archive page tempers the AV:N signal - this is not drive-by exploitation of a default install. No SSVC decision data was provided. Net: a genuine but conditional vulnerability, appropriate priority for sites that allow user self-registration and have the bio feature enabled, lower priority elsewhere.

An attacker registers or obtains a subscriber-level account on a WordPress site running FV Flowplayer with the profile video bio feature enabled, then injects a malicious script through an unquoted popup shortcode attribute that is stored and rendered on their author bio/archive page. When any visitor - including an administrator browsing the author archive - loads that page, the script executes in their browser, enabling session or credential theft. No public exploit code is referenced in the provided intelligence.