CVE-2026-12135

MEDIUM

FV Flowplayer Video Player <= 7.5.51.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'video_player' Shortcode

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-12135. PoCs published by HermesNA-1.

AI-analyzed exploit summary This repository contains an auto-generated module stub for CVE-2026-12135, a stored XSS vulnerability in the FV Flowplayer Video Player WordPress plugin. The code includes metadata and a placeholder `run()` method but lacks actual exploit implementation.

Description

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_player' shortcode 'align' attribute in all versions up to, and including, 7.5.51.7212 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Exploits (1)

github STUB 1 stars

by HermesNA-1 · pythonpoc

https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2026-12135_the_flowplayer_video.py

View Code ZIP pw:eip

This repository contains an auto-generated module stub for CVE-2026-12135, a stored XSS vulnerability in the FV Flowplayer Video Player WordPress plugin. The code includes metadata and a placeholder `run()` method but lacks actual exploit implementation.

Classification

Stub 99%

Attack Type

Xss

Complexity

Moderate

Reliability

Theoretical

Target: FV Flowplayer Video Player plugin for WordPress (versions up to and including 7.5.51.7212)

No auth needed

Prerequisites: WordPress site with vulnerable FV Flowplayer Video Player plugin installed · Ability to inject malicious shortcode (e.g., via post/comment submission)

MITRE ATT&CK

T1059.007 - JavaScript T1189 - Drive-by Compromise

mistral-large-3 · analyzed Jul 09, 2026 Full analysis →