CVE-2026-96654
Awaiting Analysis Awaiting Analysis - Queue

Plex Media Server Plugin Function Parameter Injection

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-96654
EUVD
EUVD-2026-85368

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
plex media_server to 1.43.3.10861 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-84 The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Plex Media Server before version 1.43.3.10861 fails to properly neutralize URL values in the 'searchOne' parameter. This allows an attacker to inject malicious URLs that can call functions from other plugins and supply their own parameters, potentially leading to unauthorized actions.

Impact Analysis

An attacker could exploit this to perform unauthorized actions on your Plex Media Server, such as accessing sensitive data, modifying settings, or chaining further attacks. The impact depends on the plugins installed and their permissions.

Mitigation Strategies
  • Update Plex Media Server to version 1.43.3.10861 or later to address the vulnerability.
  • Monitor network traffic for unusual plugin function calls or URL parameters in the 'searchOne' field.
  • Restrict access to Plex Media Server interfaces to trusted networks or users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96654. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart