Unescaped Shortcode Attributes Enable Stored XSS in Video Player

The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded in comments before rendering them into the media player markup, allowing an unauthenticated visitor to store a script payload in a comment that executes in the session of any visitor, including an administrator, who plays the commented video, when the non-default comment-shortcode-parsing setting is enabled.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability represents a stored cross-site scripting (XSS) attack vector in the FV Flowplayer Video Player WordPress plugin, affecting versions before 7.5.57.7212. By failing to properly escape shortcode attribute values within comments, attackers can inject malicious scripts that persist in the database and execute whenever any user—including administrators—views the affected video content. The attack requires only an unauthenticated visitor to post a comment, making the barrier to exploitation exceptionally low. Organizations using this plugin with the non-default comment-shortcode-parsing setting enabled face significant risk, as the injected payload executes in the context of legitimate users' sessions, potentially leading to credential theft, malware distribution, or administrative account compromise.

Casky.ai's 323 mapped security skills detect this attack pattern by analyzing techniques aligned with TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners leveraging Claude AI's extended reasoning capabilities will identify suspicious comment submissions containing script payloads, detect the absence of input sanitization in shortcode processing, and recognize the execution of unexpected JavaScript in media player contexts. The platform correlates indicators such as HTML/script tags in comment metadata, deviations from normal comment content patterns, and subsequent unauthorized actions triggered during video playback sessions. This multi-layered detection approach enables security teams to catch both the injection attempt and post-exploitation behavior, providing visibility into how stored XSS vulnerabilities create persistent threats within WordPress ecosystems.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-117525.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-117525

Casky has 323 skills that investigate the attack patterns behind CVE-2026-117525. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn