The FV Flowplayer Video Player plugin for WordPress is vulnerable to a Stored Cross‑Site Scripting flaw that allows an unauthenticated attacker to inject arbitrary scripts through comment text. This injection results in execution of malicious code in the browser whenever a user visits a page containing the infected comment, potentially compromising confidentiality, integrity, and availability of the web application. The weakness is a classic input validation and output escaping failure, identified by CWE‑79.

All versions of the FV Flowplayer Video Player plugin by foliovision up to and including 7.5.49.7212 are affected. The vulnerability is present when the administrator enables the non‑default 'Parse Vimeo and YouTube links' (parse_comments) setting. An attacker must submit a comment that is subsequently approved by an administrator before the payload is rendered on publicly accessible pages.

The CVSS score of 7.2 indicates a high severity level. The EPSS score is not available, so the exact exploitation probability cannot be determined, but the lack of a requirement for authenticated access suggests that the vulnerability can be leveraged by anyone who can submit a comment. However, exploitation also depends on the administrator approving the comment and the special parse_comments setting being enabled. The vulnerability is not listed in the CISA KEV catalog, but the risk of sensitive data exposure or site defacement remains significant due to the stored nature of the payload.