CVE-2026-96682: Presto Player <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag
The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via <presto-player> Tag in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an initial comment approval, though WordPress default settings will auto-approve all subsequent comments from the same author, allowing a patient unauthenticated attacker to land the payload without further admin intervention.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it by submitting comment content containing a malicious <presto-player> tag. The malicious script executes when someone later accesses the page containing the approved comment.
Does exploitation require administrator interaction?
An initial malicious comment must be approved. Under default WordPress behavior, later comments from the same author may be automatically approved, allowing an attacker to submit a payload without additional administrator approval after establishing that author.
Which installations are affected?
Presto Player versions through 4.5.1, including version 4.5.1, are affected. Exposure depends on comments being usable and on an attacker obtaining approval for an initial comment.