CVE-2026-97630 foliovision CVE debrief

Who should care

Defenders responsible for WordPress installations with the FV Flowplayer Video Player plugin should assess exposure and prioritize verification and remediation efforts. This includes verifying the presence of FV Flowplayer Video Player versions up to 7.5.54.7212, ensuring the profile_videos_enable_bio option is not enabled, and restricting subscriber-level access and above to prevent exploitation. Operators, platform administrators, vulnerability managers,

Why it matters

Defenders should care about CVE-2026-97630 because it allows authenticated attackers to inject arbitrary web scripts into pages, potentially leading to script execution on author bio/archive pages. Verification of FV Flowplayer Video Player versions and configurations, as well as restriction of subscriber-level access, are necessary to prevent exploitation.

• Potential injection of arbitrary web scripts into pages
• Possible execution of scripts on author bio/archive pages
• Required verification of FV Flowplayer Video Player versions and configurations
• Potential restriction of subscriber-level access and above

Technical summary

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unquoted popup shortcode attribute. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts into pages, potentially leading to script execution on author bio/archive pages. Successful exploitation requires the profile_videos_enable_bio option to be enabled. Defenders should prioritize verifying the presence of FV Flowplayer Video Player versions up to 7.5.54.7212 and ensuring the profile_videos_enable_bio option is not enabled, or restrict subscriber-level access and above to prevent exploitation.

Defensive priority

Defenders should prioritize verifying the presence of FV Flowplayer Video Player versions up to 7.5.54.7212 and ensuring the profile_videos_enable_bio option is not enabled, or restrict subscriber-level access and above to prevent exploitation.

Recommended defensive actions

• Verify the version of FV Flowplayer Video Player and upgrade to a patched version if necessary
• Restrict subscriber-level access and above to prevent exploitation
• Disable the profile_videos_enable_bio option if not required
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on the vulnerability. Supplemental sources include code references from the FV Flowplayer Video Player plugin. Defenders should verify the presence of FV Flowplayer Video Player versions up to 7.5.54.7212 and ensure the profile_videos_enable_bio option is not enabled, or restrict subscriber-level access and above to prevent exploitation. Evidence is limited, and further verification is necessary to confirm affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.