CVE-2026-9125

Name of the Vulnerable Software and Affected Versions Presto Player versions prior to 4.2.1

Description The Presto Player plugin for WordPress contains a Stored Cross-Site Scripting issue. The getOverlays() function fails to properly sanitize input and escape output, allowing the link url parameter of the [presto player overlay] shortcode to be copied directly into the overlay configuration without scheme validation. This allows javascript: URIs to be rendered as the href of a clickable anchor element by the presto-dynamic-overlay-ui web component. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute when a user visits the affected page.

Recommendations Update to a version later than 4.2.0. As a temporary workaround, restrict the use of the link url parameter within the [presto player overlay] shortcode.