Based on the description, it is inferred that the FV Flowplayer Video Player plugin for WordPress contains a stored XSS vulnerability in the “synopsis” attribute of its shortcode. Insufficient input sanitization allows an attacker to store malicious JavaScript that is later rendered on pages when the shortcode is processed. An unauthenticated user can inject code that will execute in the browsers of all site visitors who view the affected page, enabling actions such as credential theft, session hijacking or malicious redirection.

The vulnerability affects FolioVision’s FV Flowplayer Video Player plugin for WordPress, all releases up to and including version 7.5.54.7212. Any WordPress installation that uses this plugin and is still on a vulnerable version is at risk.

The CVSS score of 7.2 indicates a high impact, while the EPSS score of less than 1% suggests that the vulnerability is not widely exploited at present. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack requires no privileged access; an unauthenticated attacker can exploit it if the “Parse Vimeo and YouTube links” option is enabled and the liststyle attribute is set to “season”, which may be the default configuration. Because the user supplied data is stored and then re‑displayed, the risk of widespread compromise is significant, especially on sites with public content creation capabilities.