FV Flowplayer Video Player <= 7.5.1.7212 Stored XSS via video_player Shortcode (CVE-2026-12135)

Vulnerability Overview Vulnerability Name: FV Flowplayer Video Player <= 7.5.1.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'video_player' Shortcode CVE ID: CVE-2026-12135 CVSS Score: 6.4 (Medium) Publication Date: June 30, 2026 Last Updated Date: July 1, 2026 Researcher: Muhammad Yudha - DJ Scope Software Type: Plugin Software Name: FV Flowplayer Video Player Affected Versions: <= 7.5.1.7212 Fixed Version: 7.5.52.7212 or later Remediation Remediation Measure: Update to version 7.5.52.7212 or later Vulnerability Description The FV Flowplayer Video Player plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability. This vulnerability is triggered via the attribute of the shortcode and affects all versions up to and including 7.5.1.7212. Due to insufficient input sanitization and output escaping, attackers can inject arbitrary scripts that execute when users visit pages containing the injected code. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Additional Information Share Options: Facebook, X (Twitter), LinkedIn, Email Recent Vulnerabilities FV Flowplayer Video Player <= 7.5.49.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Text - CVE ID: CVE-2026-7556 - CVSS Score: 7.2 - Researchers: stealthcopier, therpier17y - Date: June 8, 2026 FV Flowplayer Video Player <= 7.5.1.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting - CVE ID: CVE-2026-49773 - CVSS Score: 6.4 - Researcher: Jakub Herman - Date: June 4, 2026 Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library - CVE ID: CVE-2024-5020 - CVSS Score: 6.4 - Researcher: Webernaut - Date: December 3, 2024 FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter - CVE ID: CVE-2024-4338 - CVSS Score: 8.8 - Researcher: Arkadiusz Hydżik - Date: July 18, 2024 FV Flowplayer Video Player <= 7.5.45.7212 - Reflected Cross-Site Scripting - CVE ID: CVE-2024-35631 - CVSS Score: 6.1 - Researcher: Dimas Maulana - Date: May 27, 2024 FV Flowplayer Video Player <= 7.5.43.7212 - Authenticated (Subscriber+) Server-side Request Forgery - CVE ID: CVE-2024-32955 - CVSS Score: 6.4 - Researcher: Steven Julian - Date: April 22, 2024 FV Flowplayer Video Player <= 7.5.44.7212 - Authenticated (Contributor+) Arbitrary Redirect - CVE ID: CVE-2024-32078 - CVSS Score: 5.4 - Researcher: Byeongun Jo - Date: April 11, 2024 FV Flowplayer Video Player <= 7.5.41.7212 - Reflected Cross-Site Scripting - CVE ID: CVE-2024-22299 - CVSS Score: 6.1 - Researcher: Rafie Muhammad - Date: March 26, 2024 FV Flowplayer Video Player <= 7.5.41.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2024-29122 - CVSS Score: 6.4 - Researcher: Byeongun Jo - Date: March 16, 2024 FV Flowplayer Video Player <= 7.5.37.7212 - Insufficient Input Validation Leading to Unauthenticated Stored Cross-Site Scripting and Arbitrary Usermeta Update - CVE ID: CVE-2023-4520 - CVSS Score: 5.4 - Researcher: István Márton - Date: August 24, 2023 Copyright Information Copyright: 2012-2026 Defiant Inc. License: Defiant License Agreement MITRE Corporation Copyright: 1999-2026 The MITRE Corporation CVE Usage License: MITRE License Agreement Contact Contact Email: wfi-support@wordfence.com Business Hours Working Hours: 9am-6pm ET, 6am-5pm PT, and 2pm-11pm UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support with a 1-hour response time Terms of Service Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media Facebook: Facebook X (Twitter): X (Twitter) LinkedIn: LinkedIn Instagram: Instagram Products and Support Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - In The News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form Subscribe for Updates Subscribe: Sign up for news and updates from our panel of experienced security professionals. Disclaimer Disclaimer: By checking this box I agree to the terms of service and privacy policy. Copyright Year Copyright Year: 2012-2026 Defiant Inc. All Rights Reserved. Additional Information Additional Information: Have information to add, or spot any errors? Contact us at wfi-support@wordfence.com so we can make any appropriate adjustments. Additional Information Additional Information: Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulne

Goal Reached Thanks to every supporter — we hit 100%!

FV Flowplayer Video Player <= 7.5.1.7212 Stored XSS via video_player Shortcode (CVE-2026-12135)