CVE-2026-96682
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via comment content with the <presto-player> tag in versions up to and including 4.5.1. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts, but require initial comment approval.
Risk Assessment
The risk includes script execution in users' browsers, potentially leading to data theft or session hijacking. WordPress default settings may auto-approve subsequent comments from the same author.
Recommendation
Update the Presto Player plugin to the latest version. Administrators should also consider disabling automatic comment approval.
Other vulnerabilities in Presto Player
See all- CVE-2026-109893Medium
The WordPress plugin 'Presto Player' (versions up to 4.5.3) has a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation.
- CVE-2026-102914Medium
The Presto Player plugin (presto-player) up to version 4.5.2 has a stored Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation.
Original NVD description (English source)
The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via <presto-player> Tag in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an initial comment approval, though WordPress default settings will auto-approve all subsequent comments from the same author, allowing a patient unauthenticated attacker to land the payload without further admin intervention.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS