Presto Player CVE-2026-102914

Exploitation requires an authenticated WordPress account with at least low-level content-contribution privileges (PR:L) able to save data through a Presto Player field, plus a second victim user who subsequently views the stored malicious content (UI:R). The payload persists server-side (Stored XSS), so it fires whenever the affected page is rendered. Limiting factors: the attacker cannot be fully anonymous - some authenticated role is needed - and impact depends on a privileged victim loading the content; sites that restrict contributor/author registration or do not expose the affected Presto Player feature are substantially less exposed. Affected versions are Presto Player up to and including 4.5.2.

This is a medium-severity Stored XSS (CWE-79) in the Presto Player WordPress plugin, rated CVSS 6.5 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The attack vector is network-based with low complexity, but it requires some level of authentication (PR:L - low privileges, typically a contributor/author-level account capable of saving plugin content) and victim user interaction (UI:R), which materially lowers real-world urgency compared to an unauthenticated RCE. The scope-changed flag (S:C) reflects that injected script executes in the victim's browser context, impacting data and sessions beyond the vulnerable component, but each of C/I/A is only Low. No EPSS score, CISA KEV listing, SSVC decision data, or public exploit was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a legitimate but non-emergency issue - the combination of required authentication, required user interaction, and only Low impacts places it well below the priority of a high-CVSS unauthenticated flaw. Patch availability is implied by the affected range ending 'through 4.5.2' (suggesting a fix beyond 4.5.2) but no explicit fixed version is stated in the input and should be verified with the Patchstack advisory.

An authenticated low-privileged user (e.g., a contributor or author) submits content through a Presto Player field that is improperly sanitized, embedding a malicious JavaScript payload that is stored persistently. When a higher-privileged user such as an administrator later views the affected page in the dashboard or front end, the script executes in their browser, potentially hijacking their session or performing actions on their behalf. No public exploit code was identified in the provided data.