A stored cross‑site scripting flaw in the FV Flowplayer Video Player plugin allows authenticated users with subscriber‑level or higher privileges to embed malicious JavaScript in shortcode attributes that are saved to the database. When a page containing the malicious payload is viewed, the script runs in the context of any user who accesses the page, opening the possibility of credential theft, session hijacking, or site defacement. The vulnerability is triggered only when the "Allow visitors to upload videos to their profile" setting is enabled, permitting subscribers to submit profile videos.

WordPress sites that install the FV Flowplayer Video Player plugin, versions up to and including 7.5.55.7212. The CVE applies to any installation where the profile video upload option is active and subscribers have been granted write access to the plugin’s shortcode parameters.

The CVSS score of 6.4 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, which suggests limited known exploitation but no definitive evidence of active attacks. Based on the description, it is inferred that the attacker must authenticate as a subscriber or higher and that the site administrator has enabled the profile‑video upload feature. Exploitation occurs by submitting a video with crafted shortcode attributes that omit proper sanitization, thereby storing the malicious script. Once stored, the payload executes on every subsequent page load by any user who views the injected content.