Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flowplayer Video Player… (CVE-2026-42695)

CVE-2026-42695 describes a stored cross-site scripting (XSS) vulnerability in the FolioVision FV Flowplayer Video Player plugin for WordPress (fv-wordpress-flowplayer). The vulnerability arises from improper neutralization of input during web page generation, which can lead to the injection and execution of malicious scripts. This affects all versions up to and including 7.5.54.7212. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges and user interaction, with scope changed and impacts on confidentiality, integrity, and availability.

An attacker with low privileges can exploit this vulnerability to execute arbitrary scripts in the context of other users, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability as indicated by the CVSS vector. This can affect users interacting with the vulnerable plugin on a website.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, consider restricting user input or applying web application firewall (WAF) rules to mitigate exploitation.