CVE-2026-96654

Plex Media Server · CISA Known Exploited Vulnerability · NIST NVD ↗

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

MEDIUM
CVSS severity
6.5
CVSS base score
2026-09-23
Published
2026-10-23
CISA remediate by

CWE codes

CWE-84

Affected products

plex:media_server

Sources