Atomic Edge analysis of CVE-2026-7556 (metadata-based):
This vulnerability is an unauthenticated stored cross-site scripting (XSS) issue in the FV Flowplayer Video Player plugin for WordPress, tracked as CVE-2026-7556 with a CVSS score of 7.2. The flaw affects all versions up to and including 7.5.49.7212. It allows attackers to inject arbitrary JavaScript into comment text, which executes whenever a victim user views the affected page. Exploitation requires the administrator to enable the non-default ‘Parse Vimeo and YouTube links’ (parse_comments) setting and requires the submitted comment to be approved by an administrator, but the attacker does not need any account privileges.
Root Cause:
Based on the CWE-79 classification and the description, the root cause is insufficient input sanitization and output escaping of comment text when the plugin processes Vimeo and YouTube links in comments. Atomic Edge analysis infers that the plugin likely parses comment content looking for media URLs and, when constructing the embedded player HTML, fails to properly encode or filter HTML tags or JavaScript event handlers embedded in the comment text. The description explicitly states the vulnerability occurs via the “comment text” and that the parsing is enabled by the ‘parse_comments’ setting. Without a code diff, we cannot confirm the exact vulnerable function, but the CWE implies that user-supplied text is reflected in an HTML context without escaping. The plugin probably uses a custom function like `parse_media_urls()` that builds HTML output using direct concatenation of comment fragments rather than employing WordPress’s safe output functions such as `esc_html()` or `wp_kses()`.
Exploitation:
An unauthenticated attacker submits a WordPress comment containing a malicious payload embedded within a disguised Vimeo or YouTube link. For example, the attacker could submit a comment with text like `[https://www.youtube.com/watch?v=dQw4w9WgXcQ” onmouseover=”alert(document.cookie)”]` or a string that breaks out of an attribute context. The plugin’s `parse_comments` handler will interpret this as a link, parse it, and then generate HTML for the embedded player. Because the plugin does not properly escape the link attributes, the injected `onmouseover` or other event handler becomes part of the generated HTML and is executed when a visitor’s browser renders the page. The attack vector is the standard WordPress comment submission endpoint (`/wp-comments-post.php` or the REST API endpoint `/wp/v2/comments`). The attacker sends a POST request with the `comment` parameter containing the crafted payload, along with other required comment fields (author, email, etc.). The payload remains dormant until an administrator approves the comment via the WordPress admin panel. After approval, any user visiting the page where the comment is displayed triggers the XSS.
Remediation:
The fix likely requires the plugin developers to implement proper output escaping of all comment-derived data before it is used in HTML generation. Specifically, when parsing comment text for Vimeo or YouTube links, the plugin should use `esc_url()` for any URL attributes and `esc_html()` or `wp_kses_post()` for any other text that is inserted into the page. The patched version, 7.5.50.7212, probably replaces direct HTML concatenation with safe WordPress functions like `wp_kses()` or uses `esc_attr()` for attribute values. Additionally, the plugin should consider adding a nonce check or capability check to the comment parsing function as a defense-in-depth measure. Administrator approval of comments is a secondary control but does not prevent the attack; the only reliable fix is correct output escaping at the code level.
Impact:
Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of any user who views the infected page. Since the CVSS vector shows a scope change (S:C) and low confidentiality and integrity impact (C:L/I:L), the attacker can perform actions on behalf of the victim, including stealing session cookies, reading nonce values, modifying page content via DOM manipulation, or performing actions as the logged-in user (e.g., creating new admin users if the victim is an administrator). This could lead to full site compromise if the victim is a high-privilege user. The attack does not require authentication, increasing its risk, but the requirement for admin comment approval and the non-default setting reduce the overall likelihood of exploitation in typical deployments.
