Presto Player EUVD-2026-102254

Exploitation requires an authenticated WordPress account with at least low-level content privileges (PR:L) - the attacker must be able to submit or edit content handled by Presto Player so the malicious payload is stored. Successful execution further depends on a second user (victim) viewing the affected page (UI:R), making this a two-actor, stored attack rather than a direct single-request compromise. Limiting factors: the required authenticated foothold and the dependency on victim interaction mean this cannot be triggered by a purely remote, unauthenticated attacker against a default install. Affected versions are Presto Player up to and including 4.5.3.

This is a moderate-severity Stored XSS (CWE-79) in the Presto Player WordPress plugin, carrying a CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The network vector and low attack complexity are offset by two meaningful constraints: PR:L means an authenticated account (typically a contributor/author-level user able to create or edit content) is required to plant the payload, and UI:R means a victim must subsequently view the poisoned page. The scope change (S:C) reflects the classic XSS pattern where injected script executes in other users' browser sessions, potentially reaching administrators. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no signal of active or probable exploitation - the only sources are the NVD-style record and the Patchstack advisory. On balance this is a real but not urgent issue: it is a credible privilege-escalation path (contributor-to-admin via admin session hijack) rather than a mass-exploitable unauthenticated flaw. Because EPSS and KEV data were absent rather than explicitly zero, their omission is noted, not interpreted as confirmation of low risk; the authentication prerequisite is the primary factor dampening real-world urgency.

A low-privileged authenticated WordPress user (e.g. a contributor or author with access to Presto Player media/content) injects a malicious script payload into a player field that is improperly neutralized and stored. When an administrator or other user later views the page or post rendering that player, the script executes in their browser session, enabling session/cookie theft or actions performed as the victim. No public exploit code was identified at time of analysis.