CVE-2026-95807: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in foliovision FV Player 8

The FV Player 8 plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to insufficient input sanitization and output escaping of the 'synopsis' shortcode attribute. This flaw allows authenticated attackers with contributor-level privileges or higher to inject arbitrary scripts into pages. When these pages are accessed, the injected scripts execute in the context of the user’s browser. Furthermore, if the 'Parse Vimeo and YouTube links' (parse_comments) setting is enabled, unauthenticated users can exploit this vulnerability by injecting shortcodes within comment text that the plugin processes, leading to script execution.

Successful exploitation can lead to the execution of arbitrary scripts in the context of users visiting the affected pages, potentially resulting in session hijacking, defacement, or other malicious actions. The vulnerability requires contributor-level access for direct injection via the shortcode attribute but can be exploited by unauthenticated users if the parse_comments setting is enabled. There is no indication of denial of service or direct system compromise. The CVSS score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable the 'Parse Vimeo and YouTube links' (parse_comments) setting to prevent unauthenticated exploitation via comment shortcodes. Restrict contributor-level access to trusted users only and monitor for suspicious shortcode usage. Apply any official patches or updates from the vendor once released.