Threats tagged 'ghsa-frph-g435-5hw4'

The FV Flowplayer Video Player plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'comment' parameter in all versions up to and including 7.5.55.7212. This vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires the 'Parse Vimeo and YouTube links' option to be enabled and a site administrator to approve a malicious comment containing a crafted shortcode. Once approved, the injected script executes for any visitor interacting with the video player on the affected page.