This vulnerability (CVE-2026-49773) is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). It affects FV Flowplayer Video Player versions before 7.5.51.7212. The flaw allows an attacker with low privileges and requiring user interaction to inject malicious scripts, potentially leading to partial confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 6.5, indicating medium severity. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation can lead to partial compromise of confidentiality, integrity, and availability of the affected system due to execution of malicious scripts in the context of authenticated users. The attack requires user interaction and low privileges, limiting the scope but still posing a risk of session hijacking, data theft, or other malicious actions within the application context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting user input where possible and applying web application firewall (WAF) rules to detect and block XSS payloads. Monitor vendor channels for updates and apply patches promptly once available.