CVE-2026-9125 affects Presto Player and is an authenticated Contributor+ Stored Cross-Site Scripting vulnerability in versions up to and including 4.2.0. A malicious presto_player_overlay shortcode can preserve a javascript: URI in link_url, allowing attacker-controlled JavaScript to run in the WordPress origin when another user clicks the overlay during playback.
| CVE | CVE-2026-9125 |
| Plugin Version | Presto Player <= 4.2.0, fixed in 4.2.1 |
| All Time | 4 601 633 |
| Active installations | 100 000+ |
| Publicly Published | June 11, 2026 |
| Last Updated | June 12, 2026 |
| Researcher | Dmitrii Ignatyev |
| PoC | Yes |
| Exploit | No |
| Reference | https://www.cve.org/CVERecord?id=CVE-2026-9125 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/presto-player/the-ultimate-video-player-for-wordpress-420-authenticated-contributor-stored-cross-site-scripting-via-link-url-shortcode-attribute |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| March 23, 2026 | Plugin testing and vulnerability detection in Presto Player were completed. |
| March 23, 2026 | The vulnerability was reported with PoC, description, and recommendations for remediation. |
| June 11, 2026 | CVE-2026-9125 was publicly published by Wordfence. |
Discovery of the Vulnerability
The vulnerable flow starts in getOverlays() in inc/Services/Shortcodes.php. It parses presto_player_overlay attributes embedded inside the outer player shortcode and places link_url directly in link.url. Version 4.2.0 does not restrict this value to HTTP or HTTPS and does not reject the javascript: scheme before the overlay configuration reaches the browser.
The Presto Dynamic Overlay UI component renders the resulting value as the href of an anchor element. WordPress KSES filters post markup but does not validate a dangerous protocol embedded in shortcode attribute text before the plugin parses it. The crafted link remains stored in post content and becomes active after the post is rendered.
Understanding of Stored Cross-Site Scripting attacks
Stored Cross-Site Scripting occurs when untrusted input is saved on the server and later reaches a browser-executable context. Here the shortcode is stored in WordPress post content, then Presto Player converts link_url into an overlay anchor. Ordinary HTML filtering is insufficient because the dangerous value is hidden in shortcode attribute text until the plugin processes it.
A Contributor can prepare the malicious post but cannot publish it on a default WordPress installation. After an authorized user reviews or publishes the content, JavaScript runs in the site origin when a visitor clicks the overlay. An administrator interaction can expose session-bound data and permit authenticated action abuse within the privileges available to that browser.
Exploiting the Stored Cross-Site Scripting Vulnerability
A Contributor or higher can add the following nested shortcodes to a post. Replace YOUR_WORKING_MP4_URL with a valid MP4 address, render the post, play the video, and click the overlay during the first ten seconds.
POC:
POC: [presto_player src="YOUR_WORKING_MP4_URL" class="big-overlay"] [presto_player_overlay start_time="0:00" end_time="0:10" position="top-right" text="Click me" link_url="javascript:alert(document.domain)" link_new_tab="0"] [/presto_player]____
The alert displays the current document domain and demonstrates JavaScript execution without changing credentials, site data, or configuration. The vulnerable link remains part of the saved shortcode until the post is edited or the plugin blocks the unsafe scheme.
Recommendations for Improved Security
Site owners should update Presto Player to version 4.2.1 or later. Until the update is applied, review Contributor-authored content before publication and reject presto_player_overlay shortcodes that use a non-HTTP link_url. A restrictive Content Security Policy can reduce impact but does not replace the plugin update.
Developers should validate overlay links against an explicit scheme allowlist before placing them in the player configuration, reject javascript:, data:, and other executable schemes, and escape the URL when it is rendered. WordPress URL validation and escaping functions should be applied to both the saved configuration and the final href.
By addressing Stored Cross-Site Scripting issues like CVE-2026-9125, WordPress site owners can prevent low-privileged shortcode content from becoming a browser-side execution path. Stay vigilant, stay secure.
#WordPressSecurity #StoredXSS #PluginSecurity #ShortcodeSecurity #WebsiteSafety #StayProtected #MediumVulnerability
Use CleanTalk solutions to improve the security of your website
