# CVE-2026-110533: FV Flowplayer Video Player stored XSS in profile videos

Source: https://junglewise.ai/threats/cve-2026-110533-the-fv-flowplayer-video-player-plugin-for-wordpress-is  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-110533 · Severity: medium · CVSS 6.4 · Published 2026-10-30

FV Flowplayer Video Player is a WordPress plugin that allows video playback and user profile video uploads. The plugin fails to properly sanitize user-submitted video data, allowing authenticated users with subscriber-level access to inject malicious scripts that execute in other users' browsers when they view the injected profile pages. An attacker could use this to steal credentials, perform actions on behalf of victims, or distribute malware.

Technologies: [FolioVision FV Flowplayer Video Player](https://junglewise.ai/threats/technologies/fv-flowplayer-video-player). Vendors: [FolioVision](https://junglewise.ai/threats/vendors/foliovision).

## Quick answers

**Is CVE-2026-110533 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110533 being exploited in the wild.

**How severe is CVE-2026-110533?** Medium severity, with a CVSS score of 6.4, published 30 October 2026.

**Which products and versions are affected?** FolioVision FV Flowplayer Video Player up to and including 7.5.55.7212.

**Is there a fix for CVE-2026-110533?** Yes: fixed in 7.5.55.7213 or later (based on commit 7ea0b1b addressing the XSS sanitization). Until then: Disable the "Allow visitors to upload videos to their profile" (profile_videos_enable_bio) setting until the plugin can be upgraded, which will prevent subscriber-level users from submitting profile videos that could contain malicious scripts. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110533 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-110533?** Check whether you run FolioVision FV Flowplayer Video Player at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.5.55.7213 or later (based on commit 7ea0b1b addressing the XSS sanitization)

Disable the "Allow visitors to upload videos to their profile" (profile_videos_enable_bio) setting until the plugin can be upgraded, which will prevent subscriber-level users from submitting profile videos that could contain malicious scripts.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in the fv_player_videos[_fv_player_user_video][] parameter due to insufficient input sanitization and output escaping. The vulnerability requires an authenticated subscriber-level user (or above) and depends on an administrator enabling the "Allow visitors to upload videos to their profile" setting. The injected script is stored and executed whenever any user accesses a page containing the malicious profile video.

## Affected products

- Foliovision FV Flowplayer Video Player up to and including 7.5.55.7212

## Timeline

- 2026-10-30: disclosed

## References

- [https://github.com/foliovision/fv-wordpress-flowplayer/commit/7ea0b1bcbedcfc26b43a4b41a32e51c9f81b4332](https://github.com/foliovision/fv-wordpress-flowplayer/commit/7ea0b1bcbedcfc26b43a4b41a32e51c9f81b4332)
- [https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/flowplayer/modules/ad-popup.module.js](https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/flowplayer/modules/ad-popup.module.js)

## Related threats

- [FolioVision FV Flowplayer Video Player stored XSS](https://junglewise.ai/threats/cve-2026-121764-improper-neutralization-of-input-during-web-page-generation)
- [FV Flowplayer Video Player stored XSS in comment parsing](https://junglewise.ai/threats/cve-2026-117525-the-fv-flowplayer-video-player-wordpress-plugin-before-7-5-57)
- [FV Flowplayer Video Player stored XSS in comment parameter](https://junglewise.ai/threats/cve-2026-121515-the-fv-flowplayer-video-player-plugin-for-wordpress-is)
- [FV Flowplayer Video Player stored XSS via align attribute](https://junglewise.ai/threats/cve-2026-110001-the-fv-flowplayer-video-player-plugin-for-wordpress-is)
- [FV Flowplayer Video Player stored XSS via comment parameter](https://junglewise.ai/threats/cve-2026-109984-the-fv-flowplayer-video-player-plugin-for-wordpress-is)