CVE-2026-66591

MediumCVSS 6.5

Published: 18/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media Library Assistant allows Stored XSS. This issue affects Media Library Assistant from n/a through 3.39.

Risk Assessment

An attacker can inject a malicious script that executes in the administrator's browser, potentially leading to session theft, defacement, or other damage.

Recommendation

Update the Media Library Assistant plugin to a version newer than 3.39 if available, or apply other XSS protection measures.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39.