CVE-2026-97398

The FV Flowplayer Video Player plugin for WordPress (versions up to and including 7.5.54.7212 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the 'synopsis' Shortcode Attribute . Unauthenticated attackers can inje...

CVE-2026-95807

The FV Player 8 plugin for WordPress (versions up to and including 8.1.7 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'synopsis' shortcode attribute . The root cause is insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or hi...