# CVE-2026-6642: Media Library Assistant Stored XSS in bulk edit preset import

Source: https://junglewise.ai/threats/cve-2026-6642-media-library-assistant-stored-xss-in-bulk-edit-preset-import  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-6642 · Severity: medium · CVSS 6.4 · Published 2026-09-11

The Media Library Assistant WordPress plugin contains a stored cross-site scripting vulnerability in its bulk edit preset export/import feature. An authenticated attacker with author-level permissions can inject malicious scripts into preset configurations that execute when an administrator imports and uses the compromised preset. This could allow an attacker to perform unauthorized actions on behalf of administrators or steal sensitive information from the WordPress admin interface.

## Quick answers

**Is CVE-2026-6642 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6642 being exploited in the wild.

**How severe is CVE-2026-6642?** Medium severity, with a CVSS score of 6.4, published 11 September 2026.

**Which products and versions are affected?** Awesome Motive Media Library Assistant up to and including 3.35.

**Is there a fix for CVE-2026-6642?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-6642 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-6642?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the mla_generate_bulk_edit_form_fieldsets() function and mla-bulk-edit-fieldsets.tpl template. Preset field values are rendered directly into HTML attribute contexts without proper escaping using esc_attr(). While wp_kses() filtering is applied during export for users lacking unfiltered_html capability, this does not prevent attribute injection attacks that use quotes and HTML attributes rather than HTML tags. Authenticated attackers with Author-level access and upload_files capability can inject arbitrary JavaScript that executes in the browser when an administrator imports the malicious preset and the targeted input field receives focus. The vulnerability affects versions up to and including 3.35.

## Affected products

- Awesome Motive Media Library Assistant up to and including 3.35

## Timeline

- 2026-09-11: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.35/includes/class-mla-ajax.php](https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.35/includes/class-mla-ajax.php)
- [https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.35/includes/class-mla-edit-media.php](https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.35/includes/class-mla-edit-media.php)