CVE-2026-49773: FV Flowplayer Video Player XSS Vulnerability

CVE-2026-49773 Overview

CVE-2026-49773 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the FV Flowplayer Video Player WordPress plugin in versions prior to 7.5.51.7212. The flaw allows an authenticated user with the Subscriber role to inject malicious scripts that execute in the browser context of other users. Exploitation requires user interaction, such as visiting a crafted page or content area where the injected payload renders. Because the scope is changed, a successful attack can affect resources beyond the vulnerable component, including the WordPress administrative interface. The vulnerability was published to the National Vulnerability Database (NVD) on June 15, 2026.

Critical Impact
A low-privileged Subscriber account can inject persistent or reflected JavaScript that runs in the context of higher-privileged users, enabling session theft, administrative action abuse, and content manipulation across the WordPress site.

Affected Products

FV Flowplayer Video Player WordPress plugin versions prior to 7.5.51.7212
WordPress sites using the FV Flowplayer plugin with Subscriber-level registration enabled
Any WordPress deployment integrating the vulnerable FV Flowplayer component

Discovery Timeline

2026-06-15 - CVE-2026-49773 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-49773

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79]. An authenticated user with Subscriber privileges can submit input that the plugin renders without sufficient output encoding or sanitization. When the unsanitized data is later returned to a viewer, the embedded script executes in that viewer's browser session.

The issue carries a changed scope, meaning the executed payload can interact with resources outside the plugin's direct security boundary. This typically translates to actions performed against the wider WordPress site, including administrative endpoints accessible to the victim. Confidentiality, integrity, and availability impacts are each rated low, reflecting that the attacker gains script execution in the victim's session rather than direct server-side code execution.

Root Cause

The root cause is missing or insufficient sanitization of input fields processed by the FV Flowplayer Video Player plugin. Inputs reachable by Subscriber-role accounts are stored or reflected without applying WordPress sanitization helpers such as wp_kses, esc_html, or esc_attr before being emitted into HTML output.

Attack Vector

The attack vector is network-based and requires both low privileges (a Subscriber account) and user interaction. An attacker registers or controls a Subscriber account, submits a payload containing a script element or event handler into a vulnerable plugin field, and waits for an administrator or other user to load the affected page. The script executes with the victim's privileges, which can include performing authenticated requests via the WordPress REST API or admin-ajax endpoints. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-49773

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or event handler attributes (onerror, onload) stored in plugin-related database tables.
New or modified WordPress administrator accounts created shortly after Subscriber activity.
Outbound HTTP requests from administrator browser sessions to unfamiliar external domains.
Subscriber-role accounts submitting content to FV Flowplayer endpoints they do not normally interact with.

Detection Strategies

Review WordPress audit logs for Subscriber accounts posting to plugin-controlled REST or admin-ajax endpoints.
Scan the wp_postmeta and plugin option tables for HTML or JavaScript payloads using regex patterns matching script injection.
Deploy a Web Application Firewall (WAF) rule that flags requests containing common XSS payloads to FV Flowplayer URIs.

Monitoring Recommendations

Alert on creation of new Subscriber accounts followed by content submission within short time windows.
Monitor administrator session activity for anomalous API calls originating from browser sessions during page views.
Track plugin version inventory across WordPress installations and flag any instance running below 7.5.51.7212.

How to Mitigate CVE-2026-49773

Immediate Actions Required

Update the FV Flowplayer Video Player plugin to version 7.5.51.7212 or later on all WordPress sites.
Audit existing Subscriber accounts and remove any that are unrecognized or inactive.
Inspect plugin-related database content for previously injected scripts and remove them.
Force password resets for administrator accounts that may have visited content submitted by untrusted Subscribers.

Patch Information

The vendor has released a fixed version of the FV Flowplayer Video Player plugin in 7.5.51.7212. Upgrade through the WordPress plugin manager or by replacing the plugin files. Verify the installed version after upgrade and confirm that scheduled automatic updates are functioning. See the Patchstack Vulnerability Report for advisory details.

Workarounds

Disable open user registration or restrict the default role to a custom role with no plugin interaction capabilities.
Deactivate the FV Flowplayer Video Player plugin until the patched version can be deployed.
Apply a WAF ruleset that blocks XSS payloads in POST parameters directed at the plugin's endpoints.
Enforce a strict Content Security Policy (CSP) to limit execution of inline scripts in the WordPress admin interface.

bash

# Configuration example: update the plugin via WP-CLI
wp plugin update fv-wordpress-flowplayer --version=7.5.51.7212
wp plugin get fv-wordpress-flowplayer --field=version