The FV Flowplayer Video Player contains a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability that enables stored cross-site scripting attacks. This occurs when user-supplied input is not properly sanitized before being included in web pages, potentially allowing attackers to inject malicious scripts that execute in the context of other users. The issue affects all versions up to 7.5.41.7212. The CVSS 3.1 vector indicates the attack requires network access, low attack complexity, privileges, and user interaction, with impacts on confidentiality, integrity, and availability rated as low to low to low respectively. No patch or official remediation level has been published by the vendor as of the data provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users viewing affected pages, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. However, the medium CVSS score and requirement for user interaction and privileges suggest exploitation is not trivial. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying workarounds such as input validation or sanitization at the application level if feasible. Monitor vendor communications for updates. No official remediation or temporary fix has been documented.