CVE-2026-9125
Deferred Deferred - Pending Action

Stored XSS in Presto Player WordPress Plugin

Publication date: 2026-06-12

Last updated on: 2026-06-12

Assigner: Wordfence

Description
The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_url' parameter of the [presto_player_overlay] shortcode in versions up to, and including, 4.2.0 This is due to insufficient input sanitization and output escaping in the getOverlays() function, which copies the link_url shortcode attribute directly into the overlay configuration without scheme validation, allowing javascript: URIs to survive and be rendered as the href of a clickable anchor element by the presto-dynamic-overlay-ui web component. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-12
Last Modified
2026-06-12
Generated
2026-07-02
AI Q&A
2026-06-12
EPSS Evaluated
2026-07-01
NVD
CVE-2026-9125
EUVD
EUVD-2026-36372

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
presto_player presto_player to 4.2.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Presto Player plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 4.2.0. This vulnerability exists because the plugin does not properly sanitize or escape input in the 'link_url' parameter of the [presto_player_overlay] shortcode. Specifically, the getOverlays() function copies the 'link_url' attribute directly into the overlay configuration without validating the URL scheme, allowing javascript: URIs to be included. As a result, authenticated users with contributor-level access or higher can inject malicious scripts that execute whenever a user views the affected page.

Impact Analysis

This vulnerability can allow attackers with contributor-level access or above to inject arbitrary JavaScript code into pages. When other users access these pages, the malicious scripts execute in their browsers, potentially leading to session hijacking, defacement, data theft, or other malicious actions. Because the vulnerability is a Stored Cross-Site Scripting flaw, the injected scripts persist on the site and affect all users who visit the compromised pages.

Compliance Impact

The vulnerability allows authenticated attackers with contributor-level access to inject arbitrary web scripts via stored cross-site scripting (XSS). This can lead to unauthorized access to user data or session hijacking when users access the injected pages.

Such unauthorized script execution can compromise the confidentiality and integrity of personal data, potentially violating data protection regulations like GDPR and HIPAA that require safeguarding user information against unauthorized access and ensuring secure handling of data.

Therefore, if exploited, this vulnerability could negatively impact compliance with these standards by exposing sensitive data or enabling malicious actions through the compromised web interface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9125. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart