CVE-2026-95807
MediumCVSS 6.4Summary
The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'synopsis' Shortcode Attribute in all versions up to and including 8.1.7 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages that execute when a user visits the injected page.
Risk Assessment
The injected malicious script may execute in a user's browser, potentially leading to session hijacking, data theft, or modification of site content.
Recommendation
Update the FV Player 8 plugin to a version later than 8.1.7 or remove it if unused.
Other vulnerabilities in FV Player 8
See all- CVE-2026-42699High
Unauthenticated Cross Site Scripting (XSS) vulnerability in FV Player 8 plugin up to version 8.1.8. Allows unauthorized users to inject malicious scripts into pages viewed by other users.
- CVE-2026-83526High
The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 8.1.7. The check_mimetype function lacks proper file type validation, allowing authenticated attackers with subscriber-level access or above to upload files that may be executable, leading to remote code execution. This requires exploiting a race condition.
Original NVD description (English source)
The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 8.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated visitors can also exploit this vulnerability when the 'Parse Vimeo and YouTube links' (parse_comments) setting is enabled, as this causes the plugin to process shortcodes within comment text.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS