Executive brief
Media Library Assistant is a WordPress plugin for managing media files and galleries. The plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated contributors and above to inject malicious scripts into pages. When other users view these pages, the injected scripts execute in their browsers, potentially exposing sensitive data or compromising their accounts.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Media Library Assistant plugin, affecting versions up to and including 3.35. The vulnerability exists in the 'mla_link_attributes' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts that are stored in the database and executed whenever any user accesses the affected page. This is a persistent vulnerability with no user interaction required beyond normal plugin use. A patch should be available in version 3.36 or later.
Affected products
- WordPress Media Library Assistant up to and including 3.35
Timeline
- 2026-09-11: disclosed