CVE-2026-45442
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Brainstorm Force Presto Player contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects Presto Player through version 4.1.3.
Risk Assessment
An attacker may gain access to functions or data they are not authorized for, potentially leading to unauthorized actions on the WordPress site.
Recommendation
Update Presto Player to a version later than 4.1.3. Review and correct permission configurations on the site.
Other vulnerabilities in Presto Player
See all- CVE-2026-109893Medium
The WordPress plugin 'Presto Player' (versions up to 4.5.3) has a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation.
- CVE-2026-96682High
The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via comment content with the <presto-player> tag in versions up to and including 4.5.1. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts, but require initial comment approval.
- CVE-2026-102914Medium
The Presto Player plugin (presto-player) up to version 4.5.2 has a stored Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation.
Original NVD description (English source)
Missing Authorization vulnerability in Brainstorm Force Presto Player allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Presto Player: from n/a through 4.1.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS