The FV Flowplayer Video Player plugin for WordPress is vulnerable to stored Cross‑Site Scripting because the 'align' attribute of a comment shortcode is not properly sanitized or escaped. Unauthenticated attackers can inject arbitrary JavaScript that executes whenever any user visits a page containing the comment, allowing malicious payloads such as credential theft or defacement. The flaw requires the WordPress administrator to enable the plugin's "Parse Vimeo and YouTube links" option, which causes the plugin to register shortcodes on comment text for rendering.

All deployments of the Foliovision FV Flowplayer Video Player plugin up to and including version 7.5.55.7212 are affected. The risk applies to WordPress sites that install any of these plugin versions.

The CVSS score of 5.4 indicates a moderate level of severity; the exploit probability is not quantified (EPSS not available) and the vulnerability is not listed in CISA KEV, suggesting limited public exploitation so far. Nevertheless, the vulnerability is exploitable by anyone without authentication as long as the parse_comments setting is enabled and comments containing a malicious "align" attribute can be stored in the database. An attacker can subsequently deliver client‑side attacks to all visitors of the affected site.