CVE-2026-95807

MediumCVSS 6.4

Published: 14/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'synopsis' Shortcode Attribute in all versions up to and including 8.1.7 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages that execute when a user visits the injected page.

Risk Assessment

The injected malicious script may execute in a user's browser, potentially leading to session hijacking, data theft, or modification of site content.

Recommendation

Update the FV Player 8 plugin to a version later than 8.1.7 or remove it if unused.

Other vulnerabilities in FV Player 8

CVE-2026-42699High
Unauthenticated Cross Site Scripting (XSS) vulnerability in FV Player 8 plugin up to version 8.1.8. Allows unauthorized users to inject malicious scripts into pages viewed by other users.

Original NVD description (English source)

The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 8.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated visitors can also exploit this vulnerability when the 'Parse Vimeo and YouTube links' (parse_comments) setting is enabled, as this causes the plugin to process shortcodes within comment text.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS