CVE-2026-12135: FV Flowplayer Video Player XSS Vulnerability

CVE-2026-12135 Overview

CVE-2026-12135 is a Stored Cross-Site Scripting (XSS) vulnerability in the FV Flowplayer Video Player plugin for WordPress. The flaw affects all versions up to and including 7.5.51.7212. The plugin fails to properly sanitize and escape the align attribute of the video_player shortcode. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into WordPress pages. The injected script executes in the browser of any user who visits the affected page, enabling session theft, account takeover, and redirection attacks. The vulnerability is tracked under [CWE-79] and originates in the plugin's controller/shortcodes.php file.

Critical Impact
Contributor-level users can persist malicious JavaScript that executes against site visitors and administrators, enabling privilege escalation and site compromise.

Affected Products

FV Flowplayer Video Player plugin for WordPress — all versions through 7.5.51.7212
WordPress sites permitting contributor-level or higher accounts
Sites rendering the video_player shortcode in published content

Discovery Timeline

2026-07-01 - CVE-2026-12135 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-12135

Vulnerability Analysis

The vulnerability resides in the shortcode rendering logic implemented in controller/shortcodes.php at lines 227 and 293 of the FV Flowplayer plugin. The plugin accepts a user-supplied align attribute through the video_player shortcode and reflects that value into the generated HTML without adequate sanitization or output escaping. Because shortcodes render server-side and their output is stored inside post content, the injected payload persists in the database and executes each time the page is loaded. Any authenticated user with the WordPress contributor role or higher can embed the shortcode with a malicious align value, achieving stored XSS in the context of the site origin.

Root Cause

The root cause is missing input sanitization and missing output escaping on the align shortcode attribute. WordPress provides helpers such as esc_attr() and sanitize_html_class() for exactly this scenario, but the plugin passed the raw attribute value into the rendered markup. This maps directly to [CWE-79] — Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation requires authentication at contributor level or above. An attacker authors a post that includes the video_player shortcode with a crafted align value containing HTML-breaking characters and a JavaScript payload. When an editor previews the submission or a visitor loads the published page, the browser parses the injected script in the site's origin. The scope change in the CVSS vector reflects that the executing script affects users beyond the attacker's own security context.

No verified public exploit code is available. Refer to the Wordfence Vulnerability Report and the affected WordPress Flowplayer Shortcode Code for technical details.

Detection Methods for CVE-2026-12135

Indicators of Compromise

Posts or pages containing [video_player] shortcodes with align attribute values that include <, >, ", ', onerror, onload, or <script> fragments.
Unexpected <script> tags or inline event handlers rendered inside video player container elements in page HTML.
Contributor or author accounts submitting content that references external JavaScript URLs from within shortcode attributes.

Detection Strategies

Query the wp_posts table for post_content matching video_player shortcodes where align= values contain angle brackets or JavaScript keywords.
Enable and review WordPress audit logs for content edits by contributor-level accounts, focusing on shortcode usage.
Inspect rendered pages with a headless browser or DOM scanner to identify script execution originating from video player markup.

Monitoring Recommendations

Alert on new or modified posts by low-privilege roles that include video_player shortcodes.
Monitor web server responses and Content Security Policy (CSP) violation reports for inline script execution on pages hosting the plugin.
Track authentication events for contributor and author roles, including newly created accounts and password resets.

How to Mitigate CVE-2026-12135

Immediate Actions Required

Update the FV Flowplayer Video Player plugin to a version released after 7.5.51.7212 that includes the fix committed in changeset 3586305.
Audit existing posts for malicious video_player shortcode align values and remove any injected script content.
Review contributor and author accounts, revoking access for unused or suspicious users and rotating credentials as needed.

Patch Information

The vendor addressed the vulnerability in the WordPress Flowplayer Changeset applied to controller/shortcodes.php. Administrators should upgrade through the WordPress plugin manager. Refer to the Wordfence Vulnerability Report for the exact fixed version and release notes.

Workarounds

Restrict the contributor role from using shortcodes by removing the unfiltered_html capability adjacent settings and applying a role editor to limit post content.
Deploy a Web Application Firewall (WAF) rule that blocks video_player shortcodes containing HTML metacharacters in the align attribute.
Deactivate the FV Flowplayer plugin on sites that do not require it until patching is complete.

bash

# Example WAF rule (ModSecurity) to block malicious align values
SecRule ARGS "@rx \[video_player[^\]]*align\s*=\s*[\"'][^\"']*[<>\"'][^\"']*[\"']" \
    "id:1026135,phase:2,deny,log,status:403,\
    msg:'CVE-2026-12135 FV Flowplayer video_player align XSS attempt'"