Media Library Assistant CVE-2026-113482

Exploitation requires an authenticated account with at least the WordPress Contributor role (per the description), plus the ability to insert a Media Library Assistant shortcode whose vulnerable attribute is not escaped before being emitted inside a generated link's attribute. Execution additionally requires a victim to view the page containing the stored payload (CVSS UI:R), realistically a higher-privileged user such as an administrator for the attack to gain value. Limiting factors: this is not remote-unauthenticated - an attacker must first obtain a low-trust account on the target site, and the plugin (version before 3.44) must be installed and the affected shortcode in use; sites that do not grant Contributor+ access to untrusted users are not practically exposed. Note the input CVSS states PR:H, which conflicts with the Contributor-role prerequisite described.

This is a moderate-priority, not a drop-everything, issue. The decision signals converge on routine-but-real: SSVC records Exploitation=none and Automatable=no (so no observed attacks and no mass-scanning potential), EPSS is very low at 0.15% (4th percentile), the CVE is not on CISA KEV, and vuln.today assigns a 'this_month' priority rather than act_now/emergency. The one elevated signal is SSVC Technical Impact=total, which aligns with the input CVSS 6.8 vector marking C:H/I:H/A:H - but for a stored XSS (CWE-79) that 'total' rating reflects what script execution in an admin's browser could cascade to (full admin takeover) rather than a direct unauthenticated system compromise. A key internal conflict should be verified: the CVSS vector states PR:H (high privilege) while the description states the attacker only needs the Contributor role, which in WordPress is a low-privilege authenticated role - the true barrier is lower than PR:H implies, so PR:L is more defensible and the real-world exploitability is slightly higher than the 6.8 suggests. Overall: a legitimate authenticated stored-XSS requiring an insider/low-trust account, worth patching on a normal cycle, not an emergency.

An attacker who already holds a Contributor (or higher) account on the WordPress site inserts a Media Library Assistant shortcode with a malicious value in the unescaped attribute, which is stored and later rendered inside a generated link's attribute. When a higher-privileged user such as an administrator views the page containing that content, the injected script executes in their browser session, enabling actions like account or site takeover. A public PoC reference exists via WPScan but is not verified as working exploit code, and exploitation requires that victim page view (UI:R) plus a valid low-privilege account.