Urgent: CVE-2026-49773 — What WordPress Site Owners Need to Know About the XSS in FV Flowplayer (≤ 7.5.51.7212) and How to Protect Your Sites

Date: 2026-06-05 | Author: Hong Kong Security Expert

Summary: A medium-severity stored/reflected Cross-Site Scripting (XSS) vulnerability was disclosed for the “FV Flowplayer Video Player” WordPress plugin affecting versions prior to 7.5.51.7212 (CVE-2026-49773). This vulnerability can be exploited to inject executable script into pages where the plugin outputs unescaped user-controlled data. Immediate action is recommended: update to 7.5.51.7212 or later, or apply virtual patching/mitigations until you can update.

Overview of the vulnerability

On 4 June 2026 a vulnerability affecting the FV Flowplayer Video Player plugin for WordPress was published and assigned CVE‑2026‑49773. Affected plugin versions: anything older than 7.5.51.7212.

Classification: Cross-Site Scripting (XSS) — Patch priority: Medium. CVSS 3.x score around 6.5 (moderate). The vulnerability allows an attacker to inject JavaScript delivered to users or administrators when the vulnerable plugin renders data that was not correctly sanitized/escaped.

Important operational details:

• Patched in: 7.5.51.7212
• Required privilege: reports indicate low privilege (Subscriber) may be sufficient to initiate the action; successful exploitation typically requires additional interaction (an admin visiting an infected page or a victim clicking a crafted link). This makes social-engineering-assisted and targeted attacks feasible, and in some cases mass exploitation possible.

Because XSS enables session capture, redirects, UI manipulation and chained attacks, even a “medium” XSS should be treated with urgency.

Why XSS matters for WordPress sites

Cross-Site Scripting is one of the most common and damaging web application vulnerabilities. On WordPress sites XSS often leads to:

• Session cookie theft and account takeover (administrator accounts are high-value targets)
• Injection of malicious JavaScript that loads external malware, redirects users, or displays fake admin screens
• Defacement, SEO poisoning (injecting spam links), or crypto-mining code
• Persistent infection in site content and database, causing repeated re-infection even after incomplete cleanup

Because WordPress has a large third-party ecosystem, a single vulnerable plugin can expose many sites. Attackers often combine XSS with social engineering or CSRF to escalate impact.

Who is at risk

• Sites running FV Flowplayer versions older than 7.5.51.7212.
• Sites that allow low-privilege accounts to submit content or otherwise provide input the plugin might render (reports mention Subscriber-level capability).
• High-traffic sites, multi-contributor sites, or public-content sites (forums, membership sites) where attackers can post crafted content or lure privileged users.
• Sites without WAF/CSP/monitoring for injected scripts.

Automated scanners and mass-exploit scripts mean even small sites are at risk.

How attackers might exploit this vulnerability — realistic scenarios

Common attack patterns:

1. Stored XSS through content fields
   An attacker registers or uses a low-privilege account, posts malicious content in a field that FV Flowplayer later outputs without escaping. Every visitor or an administrator viewing the page executes the injected script.
2. Reflected XSS via crafted URLs or forms
   An attacker crafts a URL or plugin endpoint containing a payload that is reflected into a page viewed by an admin/editor.
3. Social-engineering-assisted attacks
   Phishing messages link to vulnerable pages and trick an admin into clicking, leading to session theft or action spoofing (e.g., creating admin users).
4. Chained attacks
   XSS is used to plant a backdoor (e.g., upload a PHP webshell), modify site configuration, inject persistent JavaScript into themes, or alter DNS/redirects.

Persistent (stored) XSS is most dangerous because it remains until removed.

How to quickly check whether you are vulnerable

1. Confirm the plugin version
   • In WordPress admin: Plugins → Installed Plugins and check FV Flowplayer version.
   • Via WP-CLI:

     wp plugin list --status=active | grep -i flowplayer
     wp plugin get fv-wordpress-flowplayer --field=version

   • Or inspect the plugin main file header for the version string.
2. If you cannot access the dashboard
   • Check plugin files on disk: wp-content/plugins/fv-wordpress-flowplayer/readme.txt or the plugin main PHP file.
3. Search for known indicators (do not run untrusted scripts)
   • Look for tags or obfuscated JS in wp_posts.post_content, wp_options, wp_usermeta.
   • WP-CLI example:

     wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%

   • Search uploads for HTML/JS:

     grep -RIl "

# Block requests containing 
			
				
			
					

							
			
			
			





		

		
					
				 
 
   
 
  
 
 Review My Order
 0 
 
 
  
 
 
  
 
 
 
 Subtotal
 
Taxes & shipping calculated at checkout
 
 
  
 
 
 
   Checkout