Executive brief
The Media Library Assistant WordPress plugin contains a stored cross-site scripting vulnerability in its bulk edit preset export/import feature. An authenticated attacker with author-level permissions can inject malicious scripts into preset configurations that execute when an administrator imports and uses the compromised preset. This could allow an attacker to perform unauthorized actions on behalf of administrators or steal sensitive information from the WordPress admin interface.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the mla_generate_bulk_edit_form_fieldsets() function and mla-bulk-edit-fieldsets.tpl template. Preset field values are rendered directly into HTML attribute contexts without proper escaping using esc_attr(). While wp_kses() filtering is applied during export for users lacking unfiltered_html capability, this does not prevent attribute injection attacks that use quotes and HTML attributes rather than HTML tags. Authenticated attackers with Author-level access and upload_files capability can inject arbitrary JavaScript that executes in the browser when an administrator imports the malicious preset and the targeted input field receives focus. The vulnerability affects versions up to and including 3.35.
Affected products
- Awesome Motive Media Library Assistant up to and including 3.35
Timeline
- 2026-09-11: disclosed