CVE-2026-85347

MediumCVSS 6.8/10Last modified Nov 6, 2026

Description

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the affected page.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Nov 5, 2026
Last modified: Nov 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-853484.3The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attacker CVE-2026-853494.3The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to,CVE-2026-85355.3Out of bounds read in Media in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the CVE-2026-853505.3The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign be CVE-2026-853515.0The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fet CVE-2026-853527.0Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.CVE-2026-853537.5Out-of-bounds read in Windows Print Spooler Components allows an unauthorized attacker to disclose information over a network.CVE-2026-853547.0Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.CVE-2026-853557.0Inclusion of functionality from untrusted control sphere in Windows Common Log File System Driver allows an authorized attacker to elevate p CVE-2026-853567.8Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.CVE-2026-853577.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Phone Service allows an authorized at CVE-2026-853587.8Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.