WordPress FV Flowplayer Plugin XSS Vulnerability Advisory and Patch

Vulnerability Overview Vulnerability Name: Medium-priority Cross-Site Scripting (XSS) vulnerability in WordPress FV Flowplayer Video Player Plugin <= 7.5.54.7212. Vulnerability Type: Cross-Site Scripting (XSS). Risk Level: Medium. CVSS Score: 6.5. Affected Scope Affected Versions: WordPress FV Flowplayer Video Player Plugin versions <= 7.5.54.7212. Fixed Versions: 7.5.55.7212 or later. Vulnerability Description: An attacker can inject malicious scripts into the website to steal visitor data or hijack user accounts. Remediation 1. Automatic Mitigation: Use Patchstack to automatically mitigate the vulnerability and block attacks until the patched version is installed. 2. Manual Update: Update to version 7.5.55.7212 or later to resolve the vulnerability. Patchstack users can enable automatic updates exclusively for vulnerable plugins. Additional Information Reporter: Supakiad S. (m5ez). Report Date: August 18, 2026. Potential CVE Conflict: This issue has also been published under another CVE number, CVE-2026-97630, with a description identical to the current vulnerability (CVE-2026-42695). Patching the affected version will resolve all related issues. Notes User Interaction Required: Although the vulnerability can be triggered by a user with the "Required Privileges" role shown, successful exploitation requires privileged user interaction, such as clicking a malicious link, visiting a spoofed page, or submitting a form. Immediate Action: As an immediate measure, update the affected plugin. If this is not feasible, contact your hosting provider or web developer for assistance. Summary This vulnerability involves a Cross-Site Scripting (XSS) issue in the WordPress FV Flowplayer Video Player Plugin, affecting versions <= 7.5.54.7212. It is recommended to update to version 7.5.55.7212 or later to fix the vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress FV Flowplayer Plugin XSS Vulnerability Advisory and Patch

More from this source