Presto Player Vulnerabilities

The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via <presto-player> Tag in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVSS:

7.2

(Wordfence)

Affected:

up to 4.5.1

Fixed in:

4.5.2

Disclosed:

Oct 9, 2026

CVE-2026-96682 on NVD →

The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.2. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web script...

CVSS:

6.4

(Wordfence)

Affected:

up to 4.5.2

Fixed in:

4.5.3

Disclosed:

Oct 5, 2026

CVE-2026-102914 on NVD →

The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_url' parameter of the [presto_player_overlay] shortcode in versions up to, and including, 4.2.0 This is due to insufficient input sanitization and output escaping in the getOverlays() function, which copies the link_url sh...

CVSS:

6.4

(Wordfence)

Affected:

up to 4.2.0

Fixed in:

4.2.1

Disclosed:

Jun 11, 2026

CVE-2026-9125 on NVD →

The The Ultimate Video Player For WordPress – by Presto Player plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.1.3. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

(Wordfence)

Affected:

up to 4.1.3

Fixed in:

4.1.4

Disclosed:

May 19, 2026

CVE-2026-45442 on NVD →

[en] Missing Authorization vulnerability in Presto Made, Inc Presto Player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Presto Player: from n/a through 3.0.2.

Affected:

up to 3.0.3

Fixed in:

3.0.3

Disclosed:

Nov 1, 2024

CVE-2024-43285 on NVD →

The Presto Player plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

CVSS:

4.3

(Wordfence)

Affected:

up to 3.0.2

Fixed in:

3.0.3

Disclosed:

Aug 16, 2024

CVE-2024-43285 on NVD →

Affected:

up to 3.0.3

Fixed in:

3.0.3

Disclosed:

Aug 16, 2024

CVE-2024-43285 on NVD →

[en] The Ultimate Video Player For WordPress WordPress plugin before 2.2.3 does not have proper capability check when updating its settings via a REST route, allowing Contributor and above users to update them. Furthermore, due to the lack of escaping in one of the settings, this also allows them to perform Stored XSS...

Affected:

up to 2.2.3

Fixed in:

2.2.3

Disclosed:

Apr 10, 2024

CVE-2024-2428 on NVD →

The The Ultimate Video Player For WordPress – by Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's settings in all versions up to, and including, 2.2.2 due to missing authorization on a REST API endpoint and insufficient input sanitization and output escaping on the setti...

CVSS:

6.4

(Wordfence)

Affected:

up to 2.2.2

Fixed in:

2.2.3

Disclosed:

Mar 20, 2024

CVE-2024-2428 on NVD →

Affected:

up to 2.2.3

Fixed in:

2.2.3

Disclosed:

Mar 20, 2024

CVE-2024-2428 on NVD →