Executive Summary

The Presto Player plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 4.2.0. This vulnerability exists because the plugin does not properly sanitize or escape input in the 'link_url' parameter of the [presto_player_overlay] shortcode. Specifically, the getOverlays() function copies the 'link_url' attribute directly into the overlay configuration without validating the URL scheme, allowing javascript: URIs to be included. As a result, authenticated users with contributor-level access or higher can inject malicious scripts that execute whenever a user views the affected page.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers with contributor-level access or above to inject arbitrary JavaScript code into pages. When other users access these pages, the malicious scripts execute in their browsers, potentially leading to session hijacking, defacement, data theft, or other malicious actions. Because the vulnerability is a Stored Cross-Site Scripting flaw, the injected scripts persist on the site and affect all users who visit the compromised pages.

Useful 0 Not Useful 0