What is the CVSS score of CVE-2026-54198?

CVE-2026-54198 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Media Library Assistant are affected by CVE-2026-54198?

The Media Library Assistant WordPress plugin (versions up to 3.35) contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts in user…

How to fix or mitigate CVE-2026-54198?

Within 24 hours: Disable and remove the Media Library Assistant plugin from all WordPress installations; audit access logs for evidence of exploitation. Within 7 days: Deploy a patched alternative media management solution; verify WordPress core is on the latest stable version; reset administrative credentials. Within 30 days: Monitor Patchstack and vendor advisories for security updates; test any released patch in a staging environment before production deployment.

Media Library Assistant CVE-2026-54198

EUVD-2026-37055 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-16 Patchstack

GHSA-496r-7vwg-mwcf

XSS Media Library Assistant

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable reflected XSS, no auth, but requires victim click (UI:R); scope changes from anonymous attacker into authenticated browser context with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 10:21 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.35 versions.

AnalysisAI

Reflected cross-site scripting in the Media Library Assistant WordPress plugin (versions up to and including 3.35) allows unauthenticated remote attackers to inject script that executes in a victim's browser after a user-interaction event (clicking a crafted link). Per Patchstack, the issue affects David Lingren's plugin and currently has no public exploit identified at time of analysis, but the CVSS 7.1 (scope-changed) reflects that successful execution can pivot into authenticated admin contexts.

Technical ContextAI

Media Library Assistant is a popular WordPress plugin by David Lingren (CPE cpe:2.3:a:david_lingren:media_library_assistant) that extends the WordPress media library with shortcodes, taxonomies, IPTC/EXIF mapping, and gallery features. The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input is reflected back into HTML/JavaScript context without adequate output encoding or contextual escaping. In WordPress plugin ecosystems, reflected XSS in admin- or front-end-exposed handlers commonly stems from unsanitized $_GET/$_POST parameters echoed via PHP without esc_html(), esc_attr(), or wp_kses(), allowing attackers to inject arbitrary script payloads that execute in the victim's authenticated session.

RemediationAI

Upstream fix availability is not independently confirmed from the provided data - Patchstack lists the affected ceiling as 3.35 but no fixed release version was supplied, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/media-library-assistant/vulnerability/wordpress-media-library-assistant-plugin-3-35-reflected-cross-site-scripting-xss-vulnerability) and the plugin's WordPress.org page for any version published after 3.35 and upgrade immediately. Until a patched release is verified, compensating controls include deploying a WordPress-aware WAF (Patchstack, Wordfence) with virtual-patch rules for this CVE, restricting access to plugin endpoints via web-server ACLs or HTTP auth on /wp-admin (trade-off: blocks legitimate editors from remote locations), enforcing a strict Content-Security-Policy that disallows inline script (trade-off: may break other plugins/themes that rely on inline JS), and instructing administrators to avoid clicking unsolicited links to their own site while logged in. Deactivating the Media Library Assistant plugin is the most reliable mitigation if patching is not possible (trade-off: loss of extended media features).