The FV Flowplayer Video Player WordPress plugin is vulnerable to stored cross-site scripting (CWE-79) via the 'align' attribute of the 'video_player' shortcode. This vulnerability allows authenticated users with contributor-level permissions or above to inject arbitrary web scripts into pages. These scripts execute in the context of users who access the compromised pages. The issue is due to inadequate sanitization and escaping of input data. The vulnerability affects all versions up to and including 7.5.51.7212. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. No official patch or remediation guidance has been published yet.

Successful exploitation allows authenticated contributors or higher to inject persistent malicious scripts into WordPress pages via the 'align' attribute of the video_player shortcode. This can lead to unauthorized script execution in the browsers of users viewing the infected pages, potentially resulting in data theft, session hijacking, or other client-side attacks. The vulnerability does not impact availability but compromises confidentiality and integrity at a low level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the FV Flowplayer Video Player plugin if possible. Monitor for updates from the vendor or WordPress plugin repository for a security patch addressing this vulnerability.