CVE-2026-96682 in Presto Player Plugin
Summary
by MITRE • 10/10/2026
The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via <presto-player> Tag in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an initial comment approval, though WordPress default settings will auto-approve all subsequent comments from the same author, allowing a patient unauthenticated attacker to land the payload without further admin intervention.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The Presto Player plugin for WordPress contains a critical security vulnerability classified as Stored Cross-Site Scripting within versions up to and including 4.5.1. This flaw stems from insufficient input sanitization and output escaping mechanisms when processing comment content that includes the <presto-player> tag. The vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute automatically whenever a user accesses an affected page containing the malicious payload. While initial approval of comments is typically required by WordPress administrators, default settings often auto-approve subsequent comments from authors who have already had at least one comment approved. This behavior enables persistent exploitation without further administrative intervention after the first successful injection.
From a technical perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The attacker exploits the lack of proper validation on user-supplied data within comment fields that contain specific HTML tags associated with media playback functionality. When these inputs are rendered in web pages without adequate sanitization, they can execute malicious JavaScript code in the context of other users' browsers. This creates a significant risk for session hijacking, credential theft, defacement, or redirection to phishing sites depending on how the injected script is constructed and deployed by an attacker.
The operational impact extends beyond immediate client-side execution since stored XSS persists across multiple sessions until manually removed from the database. Users visiting affected pages become potential victims of malicious activities initiated through compromised scripts embedded in comments. Attackers can leverage this vector to steal sensitive information such as authentication cookies, personal data, or administrative credentials if users are logged into WordPress during their visit. Additionally, repeated exposure increases the likelihood of successful exploitation due to increased traffic volume and user engagement with affected content.
Mitigation strategies should prioritize immediate updates to version 4.5.2 or later where this issue has been addressed through enhanced input validation and output encoding practices. Administrators must also review existing comments for any previously injected malicious payloads before upgrading the plugin. Implementing Content Security Policy headers can further reduce risks by restricting script execution sources while providing visibility into attempted attacks via violation reports. Regular audits of third-party plugins ensure ongoing compliance with security best standards like OWASP Top Ten guidelines which emphasize prevention against injection flaws through rigorous input handling procedures and consistent application-level defenses across all user-facing interfaces including comment sections within WordPress environments.