What is the CVSS score of CVE-2026-6640?

CVE-2026-6640 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Media Library Assistant CVE-2026-6640

EUVD-2026-76009 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-09-11 Wordfence

GHSA-jvcp-qpqf-fhwg

WordPress XSS Media Library Assistant Wordpress Plugin

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS requires a victim to load the injected page (UI:R not UI:N); all other metrics match contributor-level network access with browser scope change.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 11, 2026 - 08:38 vuln.today

CVE Published

Sep 11, 2026 - 07:39 nvd

MEDIUM 6.4

DescriptionCVE.org

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_link_attributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Media Library Assistant WordPress plugin (versions ≤3.35) allows authenticated contributors to inject persistent malicious scripts via the unsanitized mla_link_attributes shortcode parameter. Any user who subsequently loads the injected page executes the attacker-controlled script in their browser context, enabling session hijacking, credential theft, or privilege escalation to administrator. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to hold a contributor-level (or higher) authenticated account on the target WordPress site. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 6.4 score (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a medium-severity network-accessible stored XSS with low privilege requirements and a scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Update the Media Library Assistant plugin to the version applying changeset 3512155 or later from the WordPress plugin repository - this SVN changeset represents the upstream code fix. … Detailed patch versions, workarounds, and compensating controls in full report.