Presto Player
Monthly
Stored cross-site scripting in the Presto Player plugin for WordPress (all versions up to and including 4.5.1) lets unauthenticated attackers inject arbitrary JavaScript via comment content that is processed by the <presto-player> tag, with the payload executing in the browser of any user who later views the affected page. The issue is rated 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), with the scope-change metric reflecting that the injected script affects a component beyond the vulnerable plugin itself. Exploitation depends on a single initial comment being approved by a moderator, after which WordPress's default behavior of auto-approving subsequent comments from the same author removes the need for further admin intervention; there is no CISA KEV listing and no public exploit identified at time of analysis, making this a moderate-priority issue that is largely mitigated by upgrading to 4.5.2, disabling comments, or requiring manual approval for every comment.
Stored cross-site scripting in the Brainstorm Force Presto Player WordPress plugin, affecting all versions through 4.5.3, allows an authenticated user with low-level content privileges to persist malicious JavaScript that executes in the browser of any other user who views the affected page. Successful exploitation requires a victim to interact with the crafted content (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, score 6.5), so it is a two-actor, stored attack rather than a direct unauthenticated compromise; the scope change (S:C) reflects that script executes in the context of the victim's session rather than the attacker's. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided, so the near-term risk is moderate and driven primarily by the large installed base of the plugin.
Arbitrary file deletion in the WordPress plugin Presto Player Pro (versions 3.0.1 and earlier) lets an authenticated account with at least Author-level privileges supply a traversal path to a plugin file-handling function and delete files outside the intended scope, including files elsewhere in the WordPress installation. Patchstack scores it CVSS 6.8 with high availability impact and no confidentiality or integrity impact, and no publicly available exploit code or active exploitation was identified at time of analysis. The realistic exposure is gated by the privilege requirement: sites that do not host untrusted Author accounts or allow open author-tier self-registration are substantially less exposed.
Stored cross-site scripting in the Presto Player WordPress plugin (Brainstorm Force) through version 4.5.2 lets an authenticated attacker with at least low-level content-contribution privileges save a malicious payload into a Presto Player field, which then executes in the browser of any user who views the affected page. Because the assessed vector is PR:L/UI:R with a scope change (S:C), the attacker cannot be fully anonymous and the impact depends on a second, potentially privileged victim loading the stored content, which is why this is rated medium severity at CVSS 6.5. There is no public exploit identified at time of analysis and no confirmed active exploitation; the only public reference is the Patchstack advisory.
Stored XSS in the Presto Player WordPress plugin (versions ≤ 4.2.0) lets authenticated contributors persist arbitrary JavaScript payloads by supplying a javascript: URI as the link_url parameter of the [presto_player_overlay] shortcode. The getOverlays() function in Shortcodes.php copies the attribute into overlay configuration without scheme validation, causing the URI to survive into the href attribute rendered by the presto-dynamic-overlay-ui Stencil.js web component; any visitor who loads the injected page triggers execution. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity within the contributor-access constraint makes this a realistic risk on multi-author or membership-based WordPress installations.
Broken access control in Brainstorm Force's Presto Player WordPress plugin (through version 4.1.3) allows authenticated low-privilege users to bypass authorization checks and read restricted data. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms this is network-exploitable by any authenticated WordPress user with no interaction required, though impact is limited to low confidentiality exposure with no integrity or availability consequences. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
The Ultimate Video Player For WordPress WordPress plugin before 2.2.3 does not have proper capability check when updating its settings via a REST route, allowing Contributor and above users to update. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting in the Presto Player plugin for WordPress (all versions up to and including 4.5.1) lets unauthenticated attackers inject arbitrary JavaScript via comment content that is processed by the <presto-player> tag, with the payload executing in the browser of any user who later views the affected page. The issue is rated 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), with the scope-change metric reflecting that the injected script affects a component beyond the vulnerable plugin itself. Exploitation depends on a single initial comment being approved by a moderator, after which WordPress's default behavior of auto-approving subsequent comments from the same author removes the need for further admin intervention; there is no CISA KEV listing and no public exploit identified at time of analysis, making this a moderate-priority issue that is largely mitigated by upgrading to 4.5.2, disabling comments, or requiring manual approval for every comment.
Stored cross-site scripting in the Brainstorm Force Presto Player WordPress plugin, affecting all versions through 4.5.3, allows an authenticated user with low-level content privileges to persist malicious JavaScript that executes in the browser of any other user who views the affected page. Successful exploitation requires a victim to interact with the crafted content (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, score 6.5), so it is a two-actor, stored attack rather than a direct unauthenticated compromise; the scope change (S:C) reflects that script executes in the context of the victim's session rather than the attacker's. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided, so the near-term risk is moderate and driven primarily by the large installed base of the plugin.
Arbitrary file deletion in the WordPress plugin Presto Player Pro (versions 3.0.1 and earlier) lets an authenticated account with at least Author-level privileges supply a traversal path to a plugin file-handling function and delete files outside the intended scope, including files elsewhere in the WordPress installation. Patchstack scores it CVSS 6.8 with high availability impact and no confidentiality or integrity impact, and no publicly available exploit code or active exploitation was identified at time of analysis. The realistic exposure is gated by the privilege requirement: sites that do not host untrusted Author accounts or allow open author-tier self-registration are substantially less exposed.
Stored cross-site scripting in the Presto Player WordPress plugin (Brainstorm Force) through version 4.5.2 lets an authenticated attacker with at least low-level content-contribution privileges save a malicious payload into a Presto Player field, which then executes in the browser of any user who views the affected page. Because the assessed vector is PR:L/UI:R with a scope change (S:C), the attacker cannot be fully anonymous and the impact depends on a second, potentially privileged victim loading the stored content, which is why this is rated medium severity at CVSS 6.5. There is no public exploit identified at time of analysis and no confirmed active exploitation; the only public reference is the Patchstack advisory.
Stored XSS in the Presto Player WordPress plugin (versions ≤ 4.2.0) lets authenticated contributors persist arbitrary JavaScript payloads by supplying a javascript: URI as the link_url parameter of the [presto_player_overlay] shortcode. The getOverlays() function in Shortcodes.php copies the attribute into overlay configuration without scheme validation, causing the URI to survive into the href attribute rendered by the presto-dynamic-overlay-ui Stencil.js web component; any visitor who loads the injected page triggers execution. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity within the contributor-access constraint makes this a realistic risk on multi-author or membership-based WordPress installations.
Broken access control in Brainstorm Force's Presto Player WordPress plugin (through version 4.1.3) allows authenticated low-privilege users to bypass authorization checks and read restricted data. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms this is network-exploitable by any authenticated WordPress user with no interaction required, though impact is limited to low confidentiality exposure with no integrity or availability consequences. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
The Ultimate Video Player For WordPress WordPress plugin before 2.2.3 does not have proper capability check when updating its settings via a REST route, allowing Contributor and above users to update. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.