The FV Flowplayer Video Player plugin for WordPress allows an unauthenticated attacker to inject malicious scripts into comment content. The stored cross‑site scripting flaw arises from insufficient sanitization and output escaping of the comment field. Once a comment containing script is approved, the script runs in the browsers of any site visitor who views the page with the injected comment, providing the attacker a persistent, client‑side attack surface.

WordPress sites that use the FV Flowplayer Video Player plugin, version 7.5.56.7212 and older. The flaw is present in all releases up to and including this version and requires the plugin option "Parse Vimeo and YouTube links" to be enabled.

The CVSS score of 5.4 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be able to post an unmoderated comment; the comment must later be approved before the payload executes. Because the attack requires unauthenticated write access to the comment system and is limited by the approval step, the overall exploitation risk is moderate but non‑negligible. A successful exploitation leads to client‑side script execution, potentially allowing session hijacking, phishing, or further malicious payload delivery.