Quick answers
- Is CVE-2026-121515 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-121515 being exploited in the wild.
- How severe is CVE-2026-121515?
- Medium severity, with a CVSS score of 5.4, published 7 November 2026.
- Which products and versions are affected?
- FolioVision FV Flowplayer Video Player up to and including 7.5.56.7212.
- Is there a fix for CVE-2026-121515?
- A patch was published on 2026-11-03: Security commit addressing sanitization of user input shortcodes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-121515 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-121515?
- Check whether you run FolioVision FV Flowplayer Video Player at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Stored cross-site scripting (XSS) vulnerability in the comment parameter due to insufficient input sanitization and output escaping. The vulnerability requires the 'Parse Vimeo and YouTube links' feature to be enabled and the injected comment to be approved by a moderator before the script executes. Attack vector is network with low preconditions; unauthenticated users can submit comments.
Affected products
- Foliovision FV Flowplayer Video Player up to and including 7.5.56.7212
Timeline
- 2026-11-07: disclosed
- 2026-11-03: patched: Security commit addressing sanitization of user input shortcodes