CVE-2026-9125

Summary: CVE-2026-9125 affects the Presto Player plugin for WordPress (up to version 4.2.0). The root cause is insufficient input sanitization and output escaping in the getOverlays() function, which copies the link_url shortcode attribute directly into the overlay configuration without scheme va...

PT-2026-48818

Name of the Vulnerable Software and Affected Versions Presto Player versions prior to 4.2.1 Description The Presto Player plugin for WordPress contains a Stored Cross-Site Scripting issue. The getOverlays function fails to properly sanitize input and escape output, allowing the link url parameter...