[ CVE-2026-85347 · Published 5 Nov 2026 ]
Vulnerability in Unknown FV Flowplayer Video Player
Not scored yet
No fix listed yet
[ Description ]Official description
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the affected page.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.