{"affected":[{"defaultStatus":"unaffected","product":"FV Player 8","source":"CNA: Wordfence","vendor":"foliovision","versions":[{"lessThanOrEqual":"8.1.9","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-110531","cwes":["CWE-79"],"description":"The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos' parameter in all versions up to, and including, 8.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the administrator-controlled \"Allow visitors to upload videos to their profile\" setting to be enabled, without which the vulnerable save routine is inaccessible to Subscriber-level users.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.4,"severity":"medium","source":"CNA: Wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1794670345847,"publishedAt":1794670345847,"references":[{"source":"CNA: Wordfence","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d581f96-5a30-49f7-bddf-45dd581d7a24?source=cve"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/fv-player/trunk/freedom-video-player/modules/overlay-popup.module.js#L95"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/fv-player-frontend.php#L1224"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/custom-videos.php#L115"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/custom-videos.php#L790"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/custom-videos.php#L757"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/fv-player/trunk/models/email-subscription.php#L762"},{"source":"CNA: Wordfence","tags":[],"url":"https://github.com/foliovision/fv-wordpress-flowplayer/commit/1c936e8100989c34e08415adfcb5ea3db2109902"}],"remediation":[],"revision":"0989eaaec963abc7125fcf871528f5ff3877ceb6f7a52ab68116f43dc24d568e","sources":[{"modifiedAt":1794670345847,"name":"CNA: Wordfence","retrievedAt":1794672500348,"url":"https://www.cve.org/CVERecord?id=CVE-2026-110531"}],"ssvc":null,"status":"published","title":"FV Player 8 <= 8.1.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Popup' Shortcode Attribute via Profile Video","updatedAt":1794672500348}