Media Library Assistant CVE-2026-61963

The target WordPress site must have the Media Library Assistant plugin installed and active in a version at or below 3.38. The CVSS vector PR:N confirms no attacker authentication is required. However, UI:R is a hard prerequisite - a victim user (ideally an authenticated WordPress user to maximize impact, given the scope change) must load or interact with attacker-controlled content that triggers the vulnerable rendering path. Exploitation is limited by this required victim interaction and by the need for the specific plugin to be installed; it does not affect WordPress sites that do not use this plugin. There is no indication that a specific non-default plugin configuration is required - the vulnerability appears present in the default installation state.

The CVSS base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects meaningful risk: the attack is network-reachable, requires no authentication, and has low complexity, meaning any internet-facing WordPress site running the plugin is a candidate target. The sole friction is the required user interaction (UI:R), meaning a victim must load or interact with a crafted page or link. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified numerically. No CISA KEV listing is present, and no POC is confirmed, indicating this is not actively weaponized at scale as of analysis. The A:L metric in the vendor-assigned vector is arguably generous for pure XSS - availability impact from script injection is uncommon without additional chaining - suggesting the NVD or Patchstack scoring may be conservative. Real-world risk is moderate: unauthenticated XSS against WordPress plugins is a well-understood attack class frequently exploited opportunistically by automated scanners, but impact is constrained by the need for victim interaction.

An attacker crafts a URL or form input containing a malicious JavaScript payload targeting a vulnerable parameter in the Media Library Assistant plugin and delivers it to a logged-in WordPress user - such as an editor or administrator - via phishing email or a forum post. When the victim loads the crafted URL while authenticated to WordPress, the injected script executes in their browser session, potentially exfiltrating session cookies, creating rogue admin accounts, or redirecting the victim to a phishing site. No confirmed POC exists at time of analysis, but this XSS class is trivially exploitable by anyone familiar with WordPress plugin attack patterns.