CVE-2026-109893
MediumCVSS 6.5Summary
The WordPress plugin 'Presto Player' (versions up to 4.5.3) has a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation.
Risk Assessment
An attacker could inject a malicious script that executes in a user's browser, potentially leading to session theft or other actions in the victim's context.
Recommendation
Update the 'Presto Player' plugin to a version newer than 4.5.3 to remove the XSS vulnerability.
Other vulnerabilities in Presto Player
See all- CVE-2026-96682High
The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via comment content with the <presto-player> tag in versions up to and including 4.5.1. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts, but require initial comment approval.
- CVE-2026-102914Medium
The Presto Player plugin (presto-player) up to version 4.5.2 has a stored Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS