Plex searchOne URL injection: chaining an unauthenticated entry point into plugin calls

CVE-2026-96654 sits one step away from the SSRF family in the same Plex Media Server patch. Its CNA description is short: the server before 1.43.3.10861 does not correctly neutralize URL values included in searchOne , which allows an attacker to call other plugins' functions and supply their own parameters. The phrase about other plugins deserves a second look.

Vulnerability overview

The CNA classifies the issue as CWE-84, improper neutralization of encoded URI schemes in a web page, with CVSS v3.1 base score 6.5 and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N . CVSS v4.0 is 6.9. Every privilege and interaction field points at an unauthenticated, remote entry point: no privileges required, no user interaction, network attack vector.…