CVE-2026-96654

MediumCVSS 6.5/10Known exploited (CISA KEV)Last modified Oct 21, 2026

Description

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-84

Affected software

Vendor	Product	Versions
Plex	Media Server	< 1.43.3.10861

References

https://forums.plex.tv/t/plex-media-server/30447/711Release Notes
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.jsonThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-96654Third Party Advisory, VDB Entry
https://zmain.info/blog/plex2shellThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654US Government Resource

Timeline

Published: Sep 23, 2026
Last modified: Oct 21, 2026
Added to CISA KEV: Oct 20, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-966554.3Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/tra CVE-2026-966567.2Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH CVE-2026-966588.8A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary CVE-2026-966599.1A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized informa CVE-2026-966607.2The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & L CVE-2026-966617.5The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter in all versions up to CVE-2026-966627.5The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection CVE-2026-966677.2The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'f CVE-2026-96675.3IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) that could allow a remote, unauthenticated CVE-2026-966718.8Cross-Site Request Forgery (CSRF) vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forger CVE-2026-966726.4Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted meth CVE-2026-966737.5Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject