CVE-2026-96654 affects Plex Media Server prior to version 1.43.3.10861. The vulnerability arises because the software does not correctly neutralize URL values included in the 'searchOne' parameter. This improper neutralization enables an attacker to call functions of other plugins and supply their own parameters, which may lead to unexpected or unauthorized actions within the application context. The CVSS 4.0 base score is 6.9, indicating a medium severity level. No known exploits are reported in the wild, and the vulnerability does not require user interaction or privileges to exploit.

An attacker can leverage this vulnerability to invoke other plugins' functions with attacker-controlled parameters, potentially causing unintended behavior or information disclosure within the Plex Media Server environment. The impact is limited to the scope of plugin functionality accessible via the 'searchOne' parameter and does not involve privilege escalation or remote code execution as per the available data.

Upgrade Plex Media Server to version 1.43.3.10861 or later, where this vulnerability has been addressed. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the affectedVersions field indicating fixed versions at 1.43.3.10861.