Plex Media Server before version 1.43.3.10861 fails to neutralize URL values supplied in the 'searchOne' parameter, which enables an attacker to invoke arbitrary plugin functions and pass custom parameters. This flaw is a classic input‑validation weakness (CWE‑84) that can lead to unauthorized execution of plugin code, potentially compromising the server’s integrity.

All installations of Plex Media Server running a release prior to 1.43.3.10861 are affected. The vulnerability specifically targets the searchOne API endpoint used by the server’s web interface and may be reachable from any network host that can communicate with the Plex server’s HTTP interface.

The CVSS score of 6.9 indicates a moderate severity level. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote over the network, requiring an attacker to send an HTTP request containing a crafted URL value to the searchOne parameter. If the target system is exposed to the internet or an untrusted internal network, exploitation could proceed without authentication, raising the risk for organizations that expose Plex Media Server to broad audiences.