CVE-2026-102914
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Presto Player plugin (presto-player) up to version 4.5.2 has a stored Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation.
Risk Assessment
An attacker can inject malicious scripts that execute in the browser of an administrator or user, potentially leading to session theft, account takeover, or malware propagation.
Recommendation
Update the Presto Player plugin to the latest version that includes security fixes. Additionally, implement security measures such as Content Security Policy (CSP).
Other vulnerabilities in Presto Player
See all- CVE-2026-109893Medium
The WordPress plugin 'Presto Player' (versions up to 4.5.3) has a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation.
- CVE-2026-96682High
The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via comment content with the <presto-player> tag in versions up to and including 4.5.1. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts, but require initial comment approval.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS