{"affected":[{"defaultStatus":"unaffected","product":"FV Flowplayer Video Player","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"7.5.56.7212","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-85347","cwes":["CWE-79"],"description":"The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the affected page.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/96c74e92-ed40-4efe-8a25-5e662b072eda/"}],"kev":null,"metrics":[],"modifiedAt":1793858424130,"publishedAt":1793858424130,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/96c74e92-ed40-4efe-8a25-5e662b072eda/"}],"remediation":[],"revision":"a4f16009be4beaa4153de88a6f2c04355da56804ca509154def8f66d6fdc2a41","sources":[{"modifiedAt":1793858424130,"name":"CNA: WPScan","retrievedAt":1793859008271,"url":"https://www.cve.org/CVERecord?id=CVE-2026-85347"}],"ssvc":null,"status":"published","title":"FV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox Caption","updatedAt":1793859008271}