CVE-2026-96654: Plex Media Server URL injection
Published Sep 23, 2026
·Updated
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.
Affected Software
1 affected component
Plex Plex Media Server<1.43.3.10861
Event History
Sep 23, 2026
CVE Published
via MITRE·04:06 PM
Data Sourced
via MITRE·04:06 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:17 PM
DescriptionSeverityWeakness
Nov 2, 58698
Event
via NVD·05:42 PM
Frequently Asked Questions
1
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates network-based exploitation with no privileges required and no user interaction required.
2
Which installations should be prioritized for remediation?
Plex Media Server versions earlier than 1.43.3.10861 are affected. The issue has low attack complexity and can allow an attacker to invoke functions in other plugins with attacker-controlled parameters.