Urgent: CVE-2026-49773 — What WordPress Site Owners Need to Know About the XSS in FV Flowplayer (≤ 7.5.51.7212) and How to Protect Your Sites

Fecha: 2026-06-05 | Autor: Experto en Seguridad de Hong Kong

Summary: A medium-severity stored/reflected Cross-Site Scripting (XSS) vulnerability was disclosed for the “FV Flowplayer Video Player” WordPress plugin affecting versions prior to 7.5.51.7212 (CVE-2026-49773). This vulnerability can be exploited to inject executable script into pages where the plugin outputs unescaped user-controlled data. Immediate action is recommended: update to 7.5.51.7212 or later, or apply virtual patching/mitigations until you can update.

Descripción general de la vulnerabilidad

On 4 June 2026 a vulnerability affecting the FV Flowplayer Video Player plugin for WordPress was published and assigned CVE‑2026‑49773. Affected plugin versions: anything older than 7.5.51.7212.

Classification: Cross-Site Scripting (XSS) — Patch priority: Medium. CVSS 3.x score around 6.5 (moderate). The vulnerability allows an attacker to inject JavaScript delivered to users or administrators when the vulnerable plugin renders data that was not correctly sanitized/escaped.

Important operational details:

• Patched in: 7.5.51.7212
• Required privilege: reports indicate low privilege (Subscriber) may be sufficient to initiate the action; successful exploitation typically requires additional interaction (an admin visiting an infected page or a victim clicking a crafted link). This makes social-engineering-assisted and targeted attacks feasible, and in some cases mass exploitation possible.

Because XSS enables session capture, redirects, UI manipulation and chained attacks, even a “medium” XSS should be treated with urgency.

Por qué XSS es importante para los sitios de WordPress

Cross-Site Scripting is one of the most common and damaging web application vulnerabilities. On WordPress sites XSS often leads to:

• Session cookie theft and account takeover (administrator accounts are high-value targets)
• Injection of malicious JavaScript that loads external malware, redirects users, or displays fake admin screens
• Defacement, SEO poisoning (injecting spam links), or crypto-mining code
• Persistent infection in site content and database, causing repeated re-infection even after incomplete cleanup

Because WordPress has a large third-party ecosystem, a single vulnerable plugin can expose many sites. Attackers often combine XSS with social engineering or CSRF to escalate impact.

Quién está en riesgo

• Sites running FV Flowplayer versions older than 7.5.51.7212.
• Sites that allow low-privilege accounts to submit content or otherwise provide input the plugin might render (reports mention Subscriber-level capability).
• High-traffic sites, multi-contributor sites, or public-content sites (forums, membership sites) where attackers can post crafted content or lure privileged users.
• Sites without WAF/CSP/monitoring for injected scripts.

Automated scanners and mass-exploit scripts mean even small sites are at risk.

How attackers might exploit this vulnerability — realistic scenarios

Patrones de ataque comunes:

1. Stored XSS through content fields
   An attacker registers or uses a low-privilege account, posts malicious content in a field that FV Flowplayer later outputs without escaping. Every visitor or an administrator viewing the page executes the injected script.
2. Reflected XSS via crafted URLs or forms
   An attacker crafts a URL or plugin endpoint containing a payload that is reflected into a page viewed by an admin/editor.
3. Social-engineering-assisted attacks
   Phishing messages link to vulnerable pages and trick an admin into clicking, leading to session theft or action spoofing (e.g., creating admin users).
4. Ataques encadenados
   XSS is used to plant a backdoor (e.g., upload a PHP webshell), modify site configuration, inject persistent JavaScript into themes, or alter DNS/redirects.

Persistent (stored) XSS is most dangerous because it remains until removed.

Cómo verificar rápidamente si eres vulnerable

1. Confirma la versión del plugin
   • In WordPress admin: Plugins → Installed Plugins and check FV Flowplayer version.
   • A través de WP-CLI:

     wp plugin list --status=active | grep -i flowplayer
     wp plugin get fv-wordpress-flowplayer --field=version

   • Or inspect the plugin main file header for the version string.
2. If you cannot access the dashboard
   • Check plugin files on disk: wp-content/plugins/fv-wordpress-flowplayer/readme.txt or the plugin main PHP file.
3. Search for known indicators (do not run untrusted scripts)
   • Busque <script tags or obfuscated JS in wp_posts.post_content, wp_options, wp_usermeta.
   • Ejemplo de WP-CLI:

     wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%

   • Search uploads for HTML/JS:

     grep -RIl "

# Block requests containing 
			
				
			
					

							
			
			
			






				
				 
 
   
 
  
 
 Revisa Mi Pedido
 0 
 
 
  
 
 
  
 
 
 
 Subtotal
 
Impuestos y envío calculados en la caja
 
 
  
 
 
 
   Pagar