# CVE-2026-121515: FV Flowplayer Video Player stored XSS in comment parameter

Source: https://junglewise.ai/threats/cve-2026-121515-the-fv-flowplayer-video-player-plugin-for-wordpress-is  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-07. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

CVE-2026-121515 · Severity: medium · CVSS 5.4 · Published 2026-11-07

FV Flowplayer is a WordPress plugin that embeds video players on websites. An unauthenticated attacker can inject malicious JavaScript into video comments that will execute when site visitors view the page, provided the 'Parse Vimeo and YouTube links' option is enabled and a site moderator approves the comment. This could allow attackers to steal user sessions, redirect visitors to malicious sites, or deface page content.

Technologies: [FolioVision FV Flowplayer Video Player](https://junglewise.ai/threats/technologies/fv-flowplayer-video-player). Vendors: [FolioVision](https://junglewise.ai/threats/vendors/foliovision).

## Quick answers

**Is CVE-2026-121515 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121515 being exploited in the wild.

**How severe is CVE-2026-121515?** Medium severity, with a CVSS score of 5.4, published 7 November 2026.

**Which products and versions are affected?** FolioVision FV Flowplayer Video Player up to and including 7.5.56.7212.

**Is there a fix for CVE-2026-121515?** A patch was published on 2026-11-03: Security commit addressing sanitization of user input shortcodes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121515 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-121515?** Check whether you run FolioVision FV Flowplayer Video Player at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Stored cross-site scripting (XSS) vulnerability in the comment parameter due to insufficient input sanitization and output escaping. The vulnerability requires the 'Parse Vimeo and YouTube links' feature to be enabled and the injected comment to be approved by a moderator before the script executes. Attack vector is network with low preconditions; unauthenticated users can submit comments.

## Affected products

- Foliovision FV Flowplayer Video Player up to and including 7.5.56.7212

## Timeline

- 2026-11-07: disclosed
- 2026-11-03: patched: Security commit addressing sanitization of user input shortcodes

## References

- [https://github.com/foliovision/fv-wordpress-flowplayer/commit/9f224f71eb16ad01330df46c30b89e8e582cf8c8](https://github.com/foliovision/fv-wordpress-flowplayer/commit/9f224f71eb16ad01330df46c30b89e8e582cf8c8)
- [https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/controller/frontend.php](https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/controller/frontend.php)

## Related threats

- [FolioVision FV Flowplayer Video Player stored XSS](https://junglewise.ai/threats/cve-2026-121764-improper-neutralization-of-input-during-web-page-generation)
- [FV Flowplayer Video Player stored XSS in comment parsing](https://junglewise.ai/threats/cve-2026-117525-the-fv-flowplayer-video-player-wordpress-plugin-before-7-5-57)
- [FV Flowplayer Video Player stored XSS in profile videos](https://junglewise.ai/threats/cve-2026-110533-the-fv-flowplayer-video-player-plugin-for-wordpress-is)
- [FV Flowplayer Video Player stored XSS via align attribute](https://junglewise.ai/threats/cve-2026-110001-the-fv-flowplayer-video-player-plugin-for-wordpress-is)
- [FV Flowplayer Video Player stored XSS via comment parameter](https://junglewise.ai/threats/cve-2026-109984-the-fv-flowplayer-video-player-plugin-for-wordpress-is)