The Ultimate Video Player For WordPress – by Presto Player <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via presto-player Tag
- ID
- WPSEC-2026-0291
- Plugin
- Presto Player (presto-player)
- Affected
- from 4.0.0 before 4.5.2
- Remediation
- Update to 4.5.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- The Ultimate Video Player For WordPress – by Presto Player on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-96682, on 2026-10-09.
Description
The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the <presto-player> custom element in versions 4.0.0 up to, and including, 4.5.1. This is due to the plugin adding the tag, with JSON-carrying attributes such as 'preset' and 'overlays', to every kses allowed-HTML context, including comments and post content saved by users without the unfiltered_html capability, while the player component parses those attributes and renders values such as the watermark and overlay text as HTML. This makes it possible for unauthenticated attackers who can post comments, as well as authenticated attackers with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
- https://wpsec.com/vuln/WPSEC-2026-0291/
- https://plugins.svn.wordpress.org/presto-player/tags/4.5.2/
- https://wordpress.org/plugins/presto-player/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS