CVE-2026-97630: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in foliovision FV Flowplayer Video Player

CVE-2026-97630 is a stored cross-site scripting vulnerability in the FV Flowplayer Video Player WordPress plugin. It occurs due to insufficient sanitization and escaping of an unquoted popup shortcode attribute, allowing authenticated attackers with subscriber-level privileges or higher to inject arbitrary scripts. These scripts execute on pages where the profile-video shortcode is rendered, specifically the author bio or archive pages, contingent on the profile_videos_enable_bio option being enabled. The vulnerability affects all versions from 0 up to and including 7.5.54.7212. The CVSS 3.1 base score is 6.4, indicating a medium severity with network attack vector, low attack complexity, and no user interaction required.

An attacker with subscriber-level access or higher can inject persistent malicious scripts that execute in the context of users visiting affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of page content. The vulnerability does not impact availability. Exploitation requires the profile_videos_enable_bio option to be enabled, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the profile_videos_enable_bio option to prevent script execution on author bio/archive pages. Restrict subscriber-level access where possible and monitor for suspicious activity related to shortcode usage.