CVE-2026-109893
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The WordPress plugin 'Presto Player' (versions up to 4.5.3) has a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation.
Risk Assessment
An attacker could inject a malicious script that executes in a user's browser, potentially leading to session theft or other actions in the victim's context.
Recommendation
Update the 'Presto Player' plugin to a version newer than 4.5.3 to remove the XSS vulnerability.
Other vulnerabilities in Presto Player
See all- CVE-2026-96682High
The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via comment content with the <presto-player> tag in versions up to and including 4.5.1. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts, but require initial comment approval.
- CVE-2026-102914Medium
The Presto Player plugin (presto-player) up to version 4.5.2 has a stored Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation.
- CVE-2026-45442Medium
Brainstorm Force Presto Player contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects Presto Player through version 4.1.3.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS