medium Known exploitedREV. 01
CVE-2026-96654Plex Media Server — searchOne Plugin Function Calls
Plex Media Server before 1.43.3.10861 does not clean link values passed to searchOne, so an attacker can call other plugins' functions with parameters of their choosing. It can be chained with three other Plex flaws.
Read the risk
THE VITAL STATS- CVSS score
- 6.9/ 10 CVSS v4.0
- EPSS probability
- 1.9% Likelihood of exploitation
- Attack complexity
- Low Conditions needed to exploit
- Known exploited
- Yes — CISA KEV
- CVE published
- 2026-09-23
- Added to KEV
- 2026-10-20
- CISA due date
- 2026-10-23
- Exploit published
- Not recorded
- Confidence
- high
- Kill chain
- unclassified
- MITRE ATT&CK
- —
- Severity
- medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker needsNetwork access to the Plex Media Server.
Fixed in1.43.3.10861
Behind the card
5 REFERENCES- 01CVE recordNVD recordnvd.nist.gov
- 02CISACISA Known Exploited Vulnerabilities catalogcisa.gov
- 03Writeupraw.githubusercontent.comraw.githubusercontent.com
- 04Writeupcve.orgcve.org
- 05Writeupzmain.infozmain.info
Field-level provenanceTRACE THE SOURCES +
Which source supports each field, when it was retrieved, and who extracted it.
| Fields | Source | Retrieved | Extractor | Confidence |
|---|---|---|---|---|
| cvss, exploitation.attack_complexity, exploitation.exploit_available, published_at, references | nvd.nist.gov | 2026-11-05 | scrty-crds-pipeline/0.1 | high |
| exploitation.known_exploited, exploitation.kev_added, exploitation.kev_due | cisa.gov | 2026-11-05 | scrty-crds-pipeline/0.1 | high |
| epss | api.first.org | 2026-11-05 | scrty-crds-pipeline/0.1 | high |
| title, subtitle, summary, severity, remediation, mitre_attack, kill_chain, recommended_action, confidence, tags, exploitation.prerequisites | nvd.nist.gov | 2026-11-05 | claude-code | high |
Printing history
THE RECORD- r1Initial base card
History unavailable — this build has no Git history for the card file.