CVE-2026-117525 — HIGH (7.5)

Vulnerability Description

The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded in comments before rendering them into the media player markup, allowing an unauthenticated visitor to store a script payload in a comment that executes in the session of any visitor, including an administrator, who plays the commented video, when the non-default comment-shortcode-parsing setting is enabled.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Related Weaknesses (CWE)

CWE-79

References

https://wpscan.com/vulnerability/d731c586-6f93-4ed0-b05d-1743a817917a/

FAQ

What is CVE-2026-117525?

CVE-2026-117525 is a vulnerability with a CVSS score of 7.5 (HIGH). The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded in comments before rendering them into the media player markup, allowing an unaut...

How severe is CVE-2026-117525?

CVE-2026-117525 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-117525?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.