CVE-2026-102914: WordPress Presto Player plugin <= 4.5.2 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

The vulnerability requires network access, low-level privileges, and user interaction. An attacker must be able to act as a low-privileged user and induce a user to view or interact with the malicious stored content.

Q: What is the potential impact if exploitation succeeds?

Successful exploitation can execute stored cross-site scripting in a victim's browser. The reported vector indicates low impacts to confidentiality, integrity, and availability, with scope changed.

Q: Which Presto Player versions are affected?

Presto Player versions through 4.5.2 are affected. The available information does not identify a fixed version.

Published Oct 5, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.2.

Affected Software

1 affected component

Brainstorm Force Presto Player<=4.5.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/presto-player to a version that resolves this vulnerability.
Fixed in 4.5.3

Event History

Oct 5, 2026

CVE Published

via MITRE·08:51 AM

Data Sourced

via MITRE·08:51 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vulnerability requires network access, low-level privileges, and user interaction. An attacker must be able to act as a low-privileged user and induce a user to view or interact with the malicious stored content.

What is the potential impact if exploitation succeeds?