Threats tagged 'ghsa-7cxc-cmc3-r76j'

The FV Flowplayer Video Player plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the 'comment' shortcode attribute 'align' in all versions up to and including 7.5.55.7212. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts into comments. Exploitation requires the plugin's 'Parse Vimeo and YouTube links' setting to be enabled, which causes shortcode attributes in comments to be rendered unescaped, affecting all users who view the injected content.