FolioVision FV Flowplayer Video Player contains improper neutralization of user input during web page generation, allowing stored malicious scripts to persist in the plugin’s database. Executed by any visitor to the affected WordPress site, the injected code can hijack sessions, redirect users, or steal sensitive data. The weakness is a classic stored XSS flaw that undermines web application integrity and can compromise users interacting with the vulnerable content.

The vulnerability exists in WordPress sites that use the FolioVision FV Flowplayer Video Player plugin through any version up to 7.5.54.7212. All installations relying on this plugin, regardless of WordPress theme or configuration, are affected.

With a CVSS score of 6.5 the issue is rated moderate severity. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation at present. Based on the description the attack vector is through ingestion of user‑supplied content that the plugin stores and later renders, allowing an attacker to embed scripts that are served to any user who views that content. The scenario requires the attacker to inject malicious code into the plugin’s stored fields, either via an administrative interface or through any input that the plugin accepts and displays.