The Presto Player plugin for WordPress contains a stored cross‑site scripting flaw that is triggered when an attacker leaves malicious content in a comment that contains the <presto-player> tag. Once the comment is approved, the payload is embedded in the page and will run in the browsers of every visitor who views that page. The flaw is triggered by insufficient input sanitization and output escaping and allows an unauthenticated attacker to inject arbitrary scripts that persist until the plugin is corrected.

The vulnerability affects all releases of the Presto Player plugin from 2winfactor up to, and including, version 4.5.1. The affected product is the WordPress plugin Presto Player, which may be used to embed media players on a site.

The CVSS score is 7.2, indicating a high severity. No EPSS score is available, and the flaw is not listed in CISA’s KEV catalog. The exploit requires only that an attacker submit a comment, which will automatically be approved for the same author if the site’s default settings are used. After the initial approval, the attacker can repeatedly supply the comment without further admin intervention, enabling persistent XSS on the site.