The vulnerability is a classic stored cross‑site scripting flaw in the Brainstorm Force Presto Player WordPress plugin. User‑supplied input that is stored in the database is later rendered without proper escaping, allowing an attacker to inject malicious scripts that will execute in the browsers of users who view affected content. The impact is the potential for client‑side code execution, which can be used to hijack sessions, deface pages, or exfiltrate data from the victim’s session. The weakness is described by the CWE-79 classification.

This weakness exists in all supported releases of the Presto Player plugin up to and including version 4.5.3, with all prior releases outside of that range also affected. The only feasible mitigation is to upgrade to the latest confirmed fix (at least version 4.5.4) or remove the plugin entirely. Users of WordPress sites that have installed any version of Presto Player prior to 4.5.4 are directly impacted.

The CVSS score of 6.5 indicates a moderate exploitability and impact. The EPSS score of < 1% suggests that, as of the current data, the probability of widespread exploitation is low, and the vulnerability is not listed in CISA’s KEV catalog, meaning no known large‑scale attacks have yet leveraged it. The likely attack vector is a user possessing the ability to submit or save content via the plugin’s forms, which then persists data to the database and is displayed later. In the absence of authentication restrictions on those inputs, an attacker could create an XSS payload that will execute for any user who views the affected content. While the exploitation requires the attacker to reach the content page, the stored nature of the flaw means repeated exploitation is possible with a single payload.