CVE-2026-7556 is a stored cross-site scripting vulnerability in the FV Flowplayer Video Player WordPress plugin affecting versions up to 7.5.49.7212. The issue stems from improper neutralization of input during web page generation (CWE-79), specifically in the handling of comment text when the 'Parse Vimeo and YouTube links' (parse_comments) setting is enabled. An attacker can submit a crafted comment containing malicious scripts that, once approved by an administrator, will execute in the browsers of users visiting the affected pages. The vulnerability requires no privileges to submit comments but depends on administrative approval and the non-default plugin setting being enabled.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected website for users who view the injected comment. This can lead to information disclosure and limited integrity impact. The vulnerability does not affect availability. The CVSS v3.1 base score is 7.2 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling the 'Parse Vimeo and YouTube links' (parse_comments) setting to prevent exploitation. Additionally, carefully review and moderate comments before approval to avoid injecting malicious content. Monitor vendor channels for official patches or updates addressing this vulnerability.