CVE-2026-42699

HighCVSS 7.1

Published: 10/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 11/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

Unauthenticated Cross Site Scripting (XSS) vulnerability in FV Player 8 plugin up to version 8.1.8. Allows unauthorized users to inject malicious scripts into pages viewed by other users.

Risk Assessment

Risk of session theft, account takeover, or spreading malware to visitors.

Recommendation

Update the FV Player 8 plugin to the latest version that includes a fix for this vulnerability.

Other vulnerabilities in FV Player 8

CVE-2026-95807Medium
The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'synopsis' Shortcode Attribute in all versions up to and including 8.1.7 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages that execute when a user visits the injected page.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS