CVE-2026-7556 Overview
CVE-2026-7556 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the FV Flowplayer Video Player plugin for WordPress in all versions up to and including 7.5.49.7212. The flaw resides in the comment text handling logic, where insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. Exploitation requires the administrator to enable the non-default parse_comments setting and to approve the malicious comment before the payload renders publicly.
Critical Impact
Unauthenticated attackers can store malicious JavaScript that executes in the browser of any visitor viewing the affected page, enabling session hijacking, credential theft, and administrative account takeover.
Affected Products
- FV Flowplayer Video Player plugin for WordPress — all versions through 7.5.49.7212
- WordPress sites with the Parse Vimeo and YouTube links (parse_comments) plugin setting enabled
- WordPress installations that allow public comment submission with administrator approval
Discovery Timeline
- 2026-06-09 - CVE-2026-7556 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-7556
Vulnerability Analysis
The vulnerability stems from how the plugin processes comment text when the parse_comments option is active. When enabled, the plugin parses Vimeo and YouTube links embedded inside user-submitted comments to render inline video players. The processing path fails to apply adequate sanitization on the comment input and does not escape output before injection into the rendered page.
An unauthenticated attacker submits a comment containing a crafted payload that abuses the link-parsing routine. After an administrator approves the comment, the stored payload is delivered to every visitor accessing the page. Because the script executes in the context of the WordPress site origin, attackers can perform actions on behalf of authenticated users, exfiltrate session cookies, or pivot toward administrative account compromise.
Root Cause
The root cause is missing input sanitization and output escaping in the comment-rendering code paths around lines 657 and 685 of controller/frontend.php. The plugin processes comment content as trusted markup after link parsing, rather than treating it as untrusted user input requiring contextual encoding.
Attack Vector
The attack is network-based and requires no privileges or authentication from the attacker. However, two preconditions raise the exploitation bar: an administrator must enable the non-default parse_comments setting, and a moderator must approve the malicious comment. Once those conditions are met, exploitation is trivial and persistent. See the Wordfence Vulnerability Report and the affected code at WordPress Flowplayer Code Line 657 for technical details.
Detection Methods for CVE-2026-7556
Indicators of Compromise
- Approved WordPress comments containing <script> tags, javascript: URIs, or HTML event handlers such as onerror= and onload=
- Unexpected outbound requests from visitor browsers to attacker-controlled domains after viewing pages with comments
- Comments containing malformed Vimeo or YouTube URLs with embedded HTML or encoded payloads
Detection Strategies
- Audit the wp_comments table for entries containing script tags, encoded payloads, or unusual URL parameters in approved comments
- Review the FV Flowplayer plugin settings to identify sites where the parse_comments option is enabled
- Inspect web server access logs for anomalous comment POST submissions from a single source targeting multiple posts
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to capture inline script execution attempts from unexpected origins
- Monitor administrator session activity for unusual privilege changes or plugin modifications after comment approvals
- Track plugin version inventory across WordPress deployments to identify hosts running 7.5.49.7212 or earlier
How to Mitigate CVE-2026-7556
Immediate Actions Required
- Update the FV Flowplayer Video Player plugin to a version newer than 7.5.49.7212 once a patched release is available
- Disable the Parse Vimeo and YouTube links (parse_comments) plugin setting if it is currently enabled
- Review and purge any pending or recently approved comments that contain suspicious markup or links
- Rotate WordPress administrator credentials and active sessions if malicious comments were approved
Patch Information
The vendor changeset addressing this issue is referenced in the WordPress Flowplayer Changeset Log. Administrators should apply the latest plugin update from the WordPress plugin repository.
Workarounds
- Keep the parse_comments option disabled, which is the default configuration
- Restrict comment approval workflows so that only trusted moderators can publish comments
- Deploy a Web Application Firewall (WAF) rule to strip or block script tags and event handlers from comment submissions
# Configuration example: disable parse_comments via WP-CLI
wp option patch update fv_flowplayer_conf parse_comments false
# Verify plugin version currently installed
wp plugin get fv-wordpress-flowplayer --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
