CVE-2026-96654 is an improper input neutralization vulnerability in the **searchOne** function of Plex Media Server prior to 1.43.3.10861 that allows an attacker to call other plugins' functions with their own parameters.

Impact

An attacker who reaches the server's internal plugin system can run plugin functions with their own input. In the Plex2Shell exploit chain, this is used to steal the server owner's admin token, which gives the attacker control of the server's settings. This vulnerability is being actively exploited and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation:

Update Plex Media Server to 1.43.3.10861 or later. Updating does not remove an existing compromise, so servers that were reachable from the internet before updating should be checked for the signs of compromise listed in Plex's advisory.