critical · CVSS v3 9.8

CVE-2026-117525

The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded i…

Description

The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded in comments before rendering them into the media player markup, allowing an unauthenticated visitor to store a script payload in a comment that executes in the session of any visitor, including an administrator, who plays the commented video, when the non-default comment-shortcode-parsing setting is enabled.

Scores

Severity
critical
CVSS v2
6.4
CVSS v3
9.8
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-17329

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to improper validation of endpoint URLs.

View analysis

critical

CVE-2026-17335

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to path traversal. File paths in uploaded content are not sufficiently validated, which could allow files to be written outside the intended location and code to be executed.

View analysis

critical

CVE-2026-17336

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

View analysis

critical

CVE-2026-17338

IBM API Connect 12.1.0.0 through 12.1.1.2 suffers from broken object‑level authorization that allows a remote authenticated attacker to access sensitive data. The flaw can expose confidential configuration and user information. It is critical because it bypasses normal access controls.

View analysis