Presto Player < 4.5.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content

Description

The plugin is vulnerable to Stored Cross-Site Scripting via comment content through the <presto-player> tag due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an initial comment approval, though WordPress default settings will auto-approve all subsequent comments from the same author, allowing a patient unauthenticated attacker to land the payload without further admin intervention.