The FV Flowplayer Video Player plugin for WordPress is vulnerable to stored Cross‑Site Scripting by abusing the 'comment' parameter, which is insufficiently sanitized and unescaped. Unauthenticated attackers can inject a malicious shortcode containing arbitrary JavaScript. When a site administrator approves the comment, the script is executed in the browser of any visitor who interacts with the video player on that page.

The vulnerability affects the foliovision FV Flowplayer Video Player plugin for WordPress, all versions up to and including 7.5.55.7212.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit this flaw without authentication, but the exploitation requires the factory setting 'Parse Vimeo and YouTube links' to be enabled and a site administrator to manually approve the malicious comment. These conditions yield a limited yet realistic attack surface for a site that allows comments and has the option enabled.