# CVE-2026-97630: FV Flowplayer Video Player stored cross-site scripting in popup shortcode

Source: https://junglewise.ai/threats/cve-2026-97630-the-fv-flowplayer-video-player-plugin-for-wordpress-is-vulnerable  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-10. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-97630 · Severity: medium · CVSS 6.4 · Published 2026-10-10

The FV Flowplayer Video Player plugin for WordPress allows authenticated users to inject malicious scripts into pages via a video shortcode attribute. When a site visitor views the affected page, the injected script executes in their browser, potentially allowing attackers to steal credentials, deface content, or redirect users to malicious sites. The vulnerability requires the site administrator to have enabled the profile videos feature.

Technologies: [FolioVision FV Flowplayer Video Player](https://junglewise.ai/threats/technologies/fv-flowplayer-video-player). Vendors: [FolioVision](https://junglewise.ai/threats/vendors/foliovision).

## Quick answers

**Is CVE-2026-97630 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97630 being exploited in the wild.

**How severe is CVE-2026-97630?** Medium severity, with a CVSS score of 6.4, published 10 October 2026.

**Which products and versions are affected?** FolioVision FV Flowplayer Video Player up to and including 7.5.54.7212.

**Is there a fix for CVE-2026-97630?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-97630 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-97630?** Check whether you run FolioVision FV Flowplayer Video Player at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting vulnerability exists in the FV Flowplayer plugin due to insufficient input sanitization and output escaping of the popup shortcode attribute. An authenticated attacker with subscriber-level access or higher can inject arbitrary JavaScript that persists in the database and executes when users view the author bio or archive page rendering the profile-video shortcode. The vulnerability is only exploitable when the profile_videos_enable_bio option is enabled.

## Affected products

- Foliovision FV Flowplayer Video Player up to and including 7.5.54.7212

## Timeline

- 2026-10-10: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/flowplayer/modules/ad-popup.module.js](https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/flowplayer/modules/ad-popup.module.js)
- [https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/models/custom-videos.php](https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/models/custom-videos.php)

## Related threats

- [FolioVision FV Flowplayer Video Player stored XSS](https://junglewise.ai/threats/cve-2026-121764-improper-neutralization-of-input-during-web-page-generation)
- [FV Flowplayer Video Player stored XSS in comment parsing](https://junglewise.ai/threats/cve-2026-117525-the-fv-flowplayer-video-player-wordpress-plugin-before-7-5-57)
- [FV Flowplayer Video Player stored XSS in comment parameter](https://junglewise.ai/threats/cve-2026-121515-the-fv-flowplayer-video-player-plugin-for-wordpress-is)
- [FV Flowplayer Video Player stored XSS in profile videos](https://junglewise.ai/threats/cve-2026-110533-the-fv-flowplayer-video-player-plugin-for-wordpress-is)
- [FV Flowplayer Video Player stored XSS via align attribute](https://junglewise.ai/threats/cve-2026-110001-the-fv-flowplayer-video-player-plugin-for-wordpress-is)