CVE-2026-7556: FV Flowplayer WordPress Plugin Stored XSS Vulnerability

Technical summary

CVE-2026-7556 is a Stored XSS vulnerability (CWE-79) arising from insufficient input sanitization and output escaping in the FV Flowplayer plugin's comment handling. When the parse_comments feature is enabled, the plugin processes comment text without adequately sanitizing or escaping user input. Attackers can craft comments containing JavaScript payloads that persist in the database and execute in visitor browsers with the privileges of the current user. The vulnerability affects all versions through 7.5.49.7212 and requires comment moderation approval before activation, creating a two-stage attack path.

Business impact

Compromised websites can serve malware, steal visitor session cookies and credentials, redirect users to phishing sites, or deface content—all while appearing to come from a trusted source. For media-heavy sites relying on video content (the Flowplayer use case), this undermines trust and may trigger search engine penalties. Organizations with high-traffic WordPress sites face reputational damage and potential regulatory liability if user data is harvested. The need for comment approval introduces friction but does reduce the attack surface compared to fully open comment systems.

Affected systems

WordPress installations using the FV Flowplayer Video Player plugin version 7.5.49.7212 or earlier are at risk, provided the 'Parse Vimeo and YouTube links' setting is enabled. This is a non-default configuration, so sites running the plugin with default settings are not vulnerable. Any WordPress site with this plugin and custom comment parsing enabled should be considered in scope for patching and testing.

Exploitability

The attack is relatively accessible: unauthenticated users can submit comments, and the barrier to exploitation is administrative approval—a process many site moderators perform routinely without close inspection of comment text. However, the requirement for both a non-default configuration and active moderation means ad-hoc attacks are less likely than coordinated campaigns targeting specific, well-known WordPress instances. The CVSS 3.1 score of 7.2 (HIGH) reflects high impact (information disclosure and integrity compromise across multiple contexts) balanced against the need for administrator-configured settings and comment approval.

Remediation

Update the FV Flowplayer plugin to the latest patched version (verify the specific version against the vendor's security advisory). As an interim measure, disable the 'Parse Vimeo and YouTube links' feature if not essential to your site's functionality. If the feature is required, implement stricter comment moderation workflows, such as requiring human review of all comments or disabling comments on sensitive content. Monitor existing comments for suspicious content and consider a Web Application Firewall (WAF) rule to block common XSS patterns in comment submissions.

Patch guidance

Check the WordPress plugin repository or the FV Flowplayer vendor website for version 7.5.49.7213 or later. Apply the update via the WordPress admin dashboard (Plugins > Installed Plugins > FV Flowplayer Video Player > Update) or manually if required. After patching, verify that the 'Parse Vimeo and YouTube links' feature continues to function correctly for legitimate use cases. Test comment submission and moderation workflows in a staging environment first to ensure no regression.

Detection guidance

Search WordPress plugin logs or audit trails for the FV Flowplayer plugin version number. Query the WordPress posts and comments tables for script tags or JavaScript event handlers (onload, onclick, onerror) in comment content. Web Application Firewalls can flag comment submissions containing script tags. Monitor for unusual comment approval activity, especially approvals by inactive or compromised admin accounts. Check browser console errors or network traffic anomalies from legitimate user sessions post-compromise. If a WAF is in place, enable logging for XSS payload attempts and review blocked requests.

Why prioritize this

This vulnerability merits prompt patching because stored XSS on WordPress sites is a common attacker objective for distributing malware and harvesting credentials at scale. Although the non-default configuration requirement and approval gate reduce the immediate threat, sites that do have the feature enabled face high impact. The vulnerability was published in June 2026 and is not on the CISA KEV list, suggesting it has not yet been exploited in the wild at scale—making this a narrow window to patch before weaponization increases.

Risk score, explained

The CVSS 3.1 score of 7.2 reflects a HIGH severity assessment: the attack requires only network access and no special privileges or user interaction (in the attacker's role), and it compromises confidentiality and integrity across browser contexts. However, the score does not fully capture the real-world friction introduced by the requirement for a non-default configuration setting and comment approval, which significantly reduces attack surface in practice. Organizations should treat this as HIGH priority for sites with the parse_comments feature enabled, but may deprioritize sites running default configurations.

Frequently asked questions