The Presto Player plugin allows an authenticated user with contributor or higher privileges to embed a [presto_player_overlay] shortcode that contains an unchecked 'link_url' attribute. When the plugin renders the overlay, the raw value of 'link_url' is inserted into an anchor tag without validating the URI scheme, permitting javascript: URLs. This enables the attacker to inject and execute arbitrary JavaScript whenever a page containing the malicious overlay is loaded by any visitor, resulting in a classic client‑side code execution flaw (CWE‑79).

The vulnerability affects the WordPress plugin Presto Player developed by 2winfactor. All releases up to and including version 4.2.0 are affected. Any WordPress installation using these versions of the plugin is potentially compromised.

The CVSS score of 6.4 indicates a moderate severity. Although no EPSS score is available, the known attack pattern requires authenticated editor-level access and the ability to insert or edit shortcodes, a privilege that is common in many sites. The flaw is not listed in CISA’s KEV catalog, suggesting that there have been no public exploit releases yet, but the technique is straightforward and could be leveraged for phishing or data theft if an attacker gains contributor access. The primary vector is through the plugin’s shortcode processing path and the lack of scheme validation in the overlay configuration.