CVE-2026-95807

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-95807
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-95807.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-95807
Published
2026-10-14T03:39:59Z
Modified
2026-10-16T02:31:04Z
Severity
  • 6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
Summary
FV Player 8 <= 8.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute
Details

The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 8.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated visitors can also exploit this vulnerability when the 'Parse Vimeo and YouTube links' (parse_comments) setting is enabled, as this causes the plugin to process shortcodes within comment text.

Database specific 
{
    "cna_assigner":  "Wordfence",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95807.json"
}
References

Affected packages

Git / github.com/foliovision/fv-wordpress-flowplayer

Affected ranges

Type
GIT
Repo
https://github.com/foliovision/fv-wordpress-flowplayer
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cc108f5affede691af0b985444071de199d94637
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "8.1.7"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

6.*
6.6.6
7.*
7.1.14.727
7.1.15.727
7.2.0.727
7.2.1.727
7.2.2.727
7.2.3.727
7.2.4.727
7.2.5.727
7.2.6.727
7.2.7.727
7.2.8.727
7.3.0.727
7.3.1.727
7.3.12.727
7.3.13.727
7.3.3.727
7.3.4.727
7.3.6.727
7.3.7.727
7.3.9.727
7.37.727
7.4.0.727
7.4.2.727
7.4.21.727
7.4.24.727
7.4.40.727
7.4.42.727
7.4.46.727
7.4.6.727
7.4.7.727
7.4.9.727
7.5.12.727
8.*
8.0.10
8.0.13
8.0.26
8.0.7
8.0.8
8.1.6
8.1.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-95807.json"