{"id":"CVE-2026-110531","summary":"FV Player 8 \u003c= 8.1.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Popup' Shortcode Attribute via Profile Video","details":"The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos' parameter in all versions up to, and including, 8.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the administrator-controlled \"Allow visitors to upload videos to their profile\" setting to be enabled, without which the vulnerable save routine is inaccessible to Subscriber-level users.","modified":"2026-11-15T02:45:14.168228322Z","published":"2026-11-14T15:32:25.847Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110531.json","unresolved_ranges":[{"extracted_events":[{"range":[{"last_affected":"8.1.9"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]}],"cna_assigner":"Wordfence","cwe_ids":["CWE-79"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110531.json"},{"type":"FIX","url":"https://github.com/foliovision/fv-wordpress-flowplayer/commit/1c936e8100989c34e08415adfcb5ea3db2109902"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110531"},{"type":"WEB","url":"https://plugins.trac.wordpress.org/browser/fv-player/trunk/freedom-video-player/modules/overlay-popup.module.js#L95"},{"type":"WEB","url":"https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/custom-videos.php#L115"},{"type":"WEB","url":"https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/custom-videos.php#L757"},{"type":"WEB","url":"https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/custom-videos.php#L790"},{"type":"WEB","url":"https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/email-subscription.php#L762"},{"type":"WEB","url":"https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/fv-player-frontend.php#L1224"},{"type":"WEB","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d581f96-5a30-49f7-bddf-45dd581d7a24?source=cve"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/foliovision/fv-wordpress-flowplayer","events":[{"introduced":"0"},{"fixed":"1c936e8100989c34e08415adfcb5ea3db2109902"}],"database_specific":{"extracted_events":[{"source":"REFERENCES_COMMIT","range":[{"fixed":"1c936e8100989c34e08415adfcb5ea3db2109902"}]}]}}],"versions":["8.1.8","8.1.7","8.1.6","8.0.26","8.0.13","8.0.10","8.0.8","8.0.7","7.5.12.727","7.4.46.727","7.4.42.727","7.4.40.727","7.4.24.727","7.4.21.727","7.4.9.727","7.4.7.727","7.4.6.727","7.4.2.727","7.4.0.727","7.3.13.727","7.3.12.727","7.3.9.727","7.37.727","7.3.7.727","7.3.6.727","7.3.4.727","7.3.3.727","7.3.1.727","7.3.0.727","7.2.8.727","7.2.7.727","7.2.6.727","7.2.5.727","7.2.4.727","7.2.3.727","7.2.2.727","7.2.1.727","7.2.0.727","7.1.15.727","7.1.14.727","6.6.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110531.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}]}