Plex Media Server URL injection

Description

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

Affected Products

Vendor	Product	Versions
plex	media server	0

References

https://www.cve.org/CVERecord?id=CVE-2026-96654(vdb-entry)
https://forums.plex.tv/t/plex-media-server/30447/711(release-notes)
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json(third-party-advisory)
https://zmain.info/blog/plex2shell(third-party-advisory)

Related News (2 articles)

Tier D

SecurityWeek2h ago

Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure

→ No new info (linked only)

Tier C

VulDB25d ago

CVE-2026-96654 | Plex Media Server up to 1.42.1 Search searchOne cross site scripting

→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.16.5 MEDIUM

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA KEV✅ Yes

Actively exploited✅ Yes

Patch available

1.43.3.10861

CWECWE-84

PublishedSep 23, 2026

Last enriched25d ago

Trending Score103🔥

Source articles2

Independent2

Info Completeness0/14

Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Plex Media Server URL injection

Description

Affected Products

References

Related News (2 articles)

Discussion (0)

Community Vote

Related CVEs (4)

Pin to Dashboard

Verification

Vulnerability Timeline