CVE-2026-7556

An unauthenticated attacker can inject arbitrary web scripts into comment text. This payload is delivered when an administrator approves the comment and a user views the page containing the approved comment. Exploitation requires the 'Parse Vimeo and YouTube links' setting to be enabled [ref_id=1]. The vulnerability is triggered when the comment text is processed and rendered on a page.

The vulnerability resides within the comment processing functions, specifically `fv_player_comment_text` and its related helper functions like `fv_player_comment_text_replace_video_urls_outside_html_tags` and `fv_player_comment_text_replace_video_urls_in_text` [ref_id=1]. These functions are responsible for parsing and rendering user-submitted comments, including those containing video URLs that are converted into shortcodes.

The patch, as indicated by the code snippet, likely involves sanitizing or escaping the comment text before it is processed by the `fv_player_comment_text` function. This would prevent injected scripts from being interpreted as executable code when the comment is displayed to users. The provided code snippet does not show the fix, but the vulnerability lies in the lack of proper escaping when handling user-submitted comments.