CVE-2026-97398: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in foliovision FV Flowplayer Video Player

CVE-2026-97398 is a stored cross-site scripting vulnerability in the FV Flowplayer Video Player WordPress plugin. It affects all versions from 0 up to 7.5.54.7212. The flaw exists because the plugin does not properly sanitize or escape input provided via the 'synopsis' shortcode attribute. When the 'Parse Vimeo and YouTube links' (parse_comments) option is enabled and the liststyle attribute is set to "season", an attacker can inject malicious scripts that execute in the browsers of users who view the injected pages. The vulnerability has a CVSS 3.1 score of 7.2, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with no availability impact.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of users visiting the affected pages. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed with the privileges of the victim user. The vulnerability impacts confidentiality and integrity but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the 'Parse Vimeo and YouTube links' option or avoid setting the liststyle attribute to "season" to prevent triggering the vulnerable code path. Monitor the vendor's communications for updates and apply any official patches once released.