CVE-2026-109893: WordPress Presto Player plugin <= 4.5.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/presto-playerto a version that resolves this vulnerability.Fixed in 4.5.4
Event History
Frequently Asked Questions
Which installations are affected?
Presto Player versions through 4.5.3 are affected. The available data does not identify a fixed version or configuration-specific limitation.
What access does an attacker need to exploit this issue?
The vector indicates network exploitation with low privileges required and user interaction required. This means an attacker must have some level of authenticated access and must induce another user to interact with attacker-controlled content.
What is the likely impact of successful exploitation?
Successful exploitation allows stored cross-site scripting. The supplied severity vector indicates low confidentiality, integrity, and availability impact, with scope changed.