The FV Player 8 plugin for WordPress is vulnerable to stored cross‑site scripting through the 'synopsis' shortcode attribute. An attacker who can authenticate with contributor‑level or higher privileges can embed arbitrary JavaScript in a synopsis field that is stored in the database and executed whenever a page containing the shortcode is rendered. Because the plugin fails to sanitize or escape the attribute, the injected code runs in the browsers of any site visitor, enabling session hijack, defacement, and delivery of malicious payloads. Unauthenticated users are not protected when the plugin’s "Parse Vimeo and YouTube links" setting is enabled, as the plugin will parse shortcodes within comment text, allowing malicious code to be injected via a comment.

All instances of the FV Player 8 WordPress plugin produced by Foliovision that are at version 8.1.7 or earlier are affected. No later releases contain this flaw.

The CVSS score of 6.4 indicates a moderate severity, and the EPSS score of less than 1% suggests a low likelihood of active exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires contributor or higher access to inject the malicious script, though it can also be used by unauthenticated users through comment parsing when the relevant setting is enabled. Once injected, the payload persists and executes in the context of any page visitor, posing a client‑compromise risk that warrants timely remediation.