Junglewise Threat Intelligence

CVE-2026-6640: WordPress Media Library Assistant stored cross-site scripting in mla_link_attributes

CVE-2026-6640 · Severity: medium · CVSS 6.4 · Published 2026-09-11

Vendors: Wordpress.

Executive brief

Media Library Assistant is a WordPress plugin for managing media files and galleries. The plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated contributors and above to inject malicious scripts into pages. When other users view these pages, the injected scripts execute in their browsers, potentially exposing sensitive data or compromising their accounts.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the Media Library Assistant plugin, affecting versions up to and including 3.35. The vulnerability exists in the 'mla_link_attributes' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts that are stored in the database and executed whenever any user accesses the affected page. This is a persistent vulnerability with no user interaction required beyond normal plugin use. A patch should be available in version 3.36 or later.

Affected products

  • WordPress Media Library Assistant up to and including 3.35

Timeline

  • 2026-09-11: disclosed

References