Plex Media Server <1.43.3.10861 'searchOne' URL Injection Allows Plugin Calls
CVE-2026-96654 Published on September 23, 2026
Plex Media Server URL injection
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.
Vulnerability Analysis
CVE-2026-96654 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Improper Neutralization of Encoded URI Schemes in a Web Page
The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.
Products Associated with CVE-2026-96654
Want to know whenever a new CVE is published for Plex Media Server? stack.watch will email you.
Affected Versions
Plex Media Server:- Before 1.43.3.10861 is affected.
- Version 1.43.3.10861 is unaffected.