{"cve":"CVE-2026-85347","enrichment":{"created":"2026-11-05T07:30:14.789019+00:00","updated":"2026-11-05T07:30:14.789024+00:00","vendors":[],"weaknesses":["CWE-79"]},"mitre":{"cpes":[],"created":"2026-11-05T06:00:24.130000+00:00","description":"The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the affected page.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/85xxx/CVE-2026-85347.json","references":["https://wpscan.com/vulnerability/96c74e92-ed40-4efe-8a25-5e662b072eda/"],"title":"FV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox Caption","updated":"2026-11-05T06:00:24.130000+00:00","vendors":[],"weaknesses":[]},"nvd":{"cpes":[],"created":"2026-11-05T06:17:08.720000+00:00","description":"The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the affected page.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-85347.json","references":["https://wpscan.com/vulnerability/96c74e92-ed40-4efe-8a25-5e662b072eda/"],"title":null,"updated":"2026-11-05T06:17:08.720000+00:00","vendors":[],"weaknesses":[]},"opencve":{"changes":[{"created":"2026-11-05T06:15:00+00:00","data":[{"details":{"new":"The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the affected page.","old":null},"type":"description"},{"details":{"new":"FV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox Caption","old":null},"type":"title"},{"details":{"added":["https://wpscan.com/vulnerability/96c74e92-ed40-4efe-8a25-5e662b072eda/"],"removed":[]},"type":"references"}],"id":"1a70f3e1-dfeb-43f1-9ea9-35a827ec57b6"},{"created":"2026-11-05T07:45:00+00:00","data":[{"details":{"added":["CWE-79"],"removed":[]},"type":"weaknesses"}],"id":"00a1bc88-079c-4ed4-a2dc-b42a0c897fff"}],"cpes":{"data":[],"providers":[]},"created":{"data":"2026-11-05T06:00:24.130000+00:00","provider":"mitre"},"description":{"data":"The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the affected page.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{},"provider":null},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{},"provider":null},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://wpscan.com/vulnerability/96c74e92-ed40-4efe-8a25-5e662b072eda/"],"providers":["mitre","nvd"]},"title":{"data":"FV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox Caption","provider":"mitre"},"updated":{"data":"2026-11-05T07:30:14.789024+00:00","provider":"enrichment"},"vendors":{"data":[],"providers":[]},"weaknesses":{"data":["CWE-79"],"providers":["enrichment"]}}}