Presto Player EUVD-2026-96106

Exploitation requires the target WordPress site to run the Presto Player plugin version 4.5.1 or earlier AND to have comments enabled on content that renders the <presto-player> shortcode/tag. The specific prerequisite stated in the description is that the attacker's initial comment must be approved by a moderator; the limiting factor is this first-comment moderation step. However, WordPress's default setting of auto-approving all subsequent comments from a previously-approved author removes the need for further admin intervention, so a patient unauthenticated attacker can reliably deliver the payload. Realistic risk is reduced on sites that disable comments, require manual approval for every comment, or have already upgraded to 4.5.2.

This is a moderate-priority issue rather than an urgent one, and the available signals are largely consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C) confirms a network-reachable, unauthenticated stored XSS with a scope change, justifying the 7.2 (High) base score through the scope impact despite only Low confidentiality and integrity. No EPSS score was provided, so statistical exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. A practical mitigating factor tempers the raw CVSS: the description states the payload requires an initial comment to be approved, which adds a real-world hurdle not captured by AC:L - WordPress default settings auto-approve subsequent comments from an already-approved author, so a patient attacker can eventually land the payload, but the first comment still depends on moderation behavior. No SSVC decision data was supplied. Overall: a legitimate stored-XSS flaw worth patching promptly on affected sites, but absent KEV/POC/EPSS signals it reflects standard WordPress-plugin XSS risk rather than mass-exploitation urgency.

An unauthenticated attacker submits a blog comment containing a crafted <presto-player> tag whose attributes carry a malicious script; once the comment is approved (and WordPress auto-approves the attacker's later comments), the injected script renders unescaped on the page. When any visitor or administrator views that page, the script executes in their browser session. No public proof-of-concept is referenced in the provided data.