What is the CVSS score of CVE-2026-9125?

CVE-2026-9125 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Presto Player CVE-2026-9125

EUVD-2026-36372 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-12 Wordfence

GHSA-2m85-j8xj-wrg2

WordPress XSS Presto Player

6.4

CVSS 3.1 · NVD

Severity by source

Vendor (Wordfence) PRIMARY

MEDIUM

qualitative

NVD

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

UI:R corrects the provided UI:N because stored XSS requires a victim to browse to the injected page; all other metrics are consistent with contributor-authenticated stored XSS with changed scope.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 12, 2026 - 02:30 vuln.today

CVE Published

Jun 12, 2026 - 01:28 nvd

MEDIUM 6.4

DescriptionNVD

The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_url' parameter of the [presto_player_overlay] shortcode in versions up to, and including, 4.2.0 This is due to insufficient input sanitization and output escaping in the getOverlays() function, which copies the link_url shortcode attribute directly into the overlay configuration without scheme validation, allowing javascript: URIs to survive and be rendered as the href of a clickable anchor element by the presto-dynamic-overlay-ui web component. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored XSS in the Presto Player WordPress plugin (versions ≤ 4.2.0) lets authenticated contributors persist arbitrary JavaScript payloads by supplying a javascript: URI as the link_url parameter of the [presto_player_overlay] shortcode. The getOverlays() function in Shortcodes.php copies the attribute into overlay configuration without scheme validation, causing the URI to survive into the href attribute rendered by the presto-dynamic-overlay-ui Stencil.js web component; any visitor who loads the injected page triggers execution. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity within the contributor-access constraint makes this a realistic risk on multi-author or membership-based WordPress installations.

Technical ContextAI

The vulnerability exists in the Presto Player plugin for WordPress (CPE: cpe:2.3:a:2winfactor:presto_player:*:*:*:*:*:*:*:*) by 2winfactor. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). Specifically, the getOverlays() function in inc/Services/Shortcodes.php reads the link_url shortcode attribute and serializes it directly into a configuration object passed to the presto-dynamic-overlays Stencil.js web component (dist/components/collection/components/core/features/presto-dynamic-overlays/component/presto-dynamic-overlays.js). That component renders the value as the href of a clickable anchor element in templates/video.php. Because no URI scheme allowlist or deny-list is enforced before serialization, javascript: URIs pass through all sanitization layers intact and execute when the anchor is rendered or interacted with. Source code references confirm this code path is present in plugin tags 4.1.1 and 4.1.4, and the fix was applied in Trac changeset 3553268 against trunk/inc/Services/Shortcodes.php.

RemediationAI

Update the Presto Player plugin to the version that includes changeset 3553268 or later; consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/c87e7f50-f14a-4751-abcb-3a5bdd214889) or the WordPress plugin repository to identify the first released patched version number, which is not confirmed from currently available data. If an immediate update is not feasible, restrict the WordPress contributor role exclusively to fully trusted, vetted users, since exploitation requires contributor-level authentication - note that this may disrupt legitimate multi-author publishing workflows. As an alternative compensating control, disable or block the [presto_player_overlay] shortcode via a shortcode-management plugin or a code snippet in functions.php until the patch is applied; this neutralizes the attack surface but will remove overlay functionality from all published content using that shortcode.