CVE-2026-113482
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
Risk Assessment
A Contributor-level user can store a malicious script that executes in the browsers of other users, including administrators. This may lead to session hijacking or actions performed on behalf of the victim.
Recommendation
Update the Media Library Assistant plugin to version 3.44 or later. Consider limiting the number of users with the Contributor role to the necessary minimum.
Other vulnerabilities in Media Library Assistant WordPress plugin
See all- CVE-2026-113481Medium
The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and posts.
- CVE-2026-113486Medium
The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action. A forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on the site.
- CVE-2026-113485Medium
The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present. A forged request that omits the field can cause a logged-in user with the Author role or above to trash or delete attachments.
- CVE-2025-11738Medium
The Media Library Assistant plugin for WordPress is vulnerable to limited file reading in all versions up to, and including, 3.29 via the mla-stream-image.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary ai/eps/pdf/ps files on the server, which can contain sensitive information.
Original NVD description (English source)
The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS