EUVD-2026-76008
GHSA-jr9v-hfwr-qhgm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS requires admin to actively import the poisoned preset and then focus the injected field, making UI:R accurate; all other metrics match the provided vector.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. This is due to insufficient output escaping on preset field values when they are rendered in HTML attribute contexts in the mla_generate_bulk_edit_form_fieldsets() function and mla-bulk-edit-fieldsets.tpl template. While wp_kses() filtering is applied during preset export for users without unfiltered_html capability, this does not prevent attribute injection attacks since the malicious payload consists of quotes and HTML attributes rather than HTML tags. When preset values are retrieved and rendered, they are directly assigned to template variables without esc_attr() escaping and then inserted into input element value attributes via simple string replacement. This makes it possible for authenticated attackers, with Author-level access and above (upload_files capability), to inject arbitrary web scripts that execute when an administrator imports the poisoned preset and the targeted input field receives focus.
AnalysisAI
Stored Cross-Site Scripting in Media Library Assistant (WordPress plugin, ≤3.35) allows authenticated attackers with Author-level access to poison bulk edit preset configurations and execute arbitrary JavaScript in the context of an administrator's browser session. The flaw bypasses the wp_kses() tag-filtering safeguard because the payload operates at the HTML attribute level - injecting closing quotes and inline event handlers - exploiting the absence of esc_attr() escaping when preset field values are rendered into <input value="..."> attributes via simple string replacement in mla_generate_bulk_edit_form_fieldsets() and the mla-bulk-edit-fieldsets.tpl template. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid WordPress account with at minimum Author-level privileges - specifically the `upload_files` capability - on the target site running Media Library Assistant ≤3.35. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.4 (Medium) score correctly reflects a lower-privilege, stored XSS with scope change (S:C), but the provided vector's UI:N metric is inconsistent with the description, which explicitly states the injected script fires only after an administrator imports the preset and then focuses the poisoned input field - a sequence that constitutes user interaction (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Media Library Assistant plugin beyond version 3.35; the upstream fix is committed to the plugin's SVN trunk at changeset 3512155 (https://plugins.trac.wordpress.org/changeset/3512155/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Media Library Assistant
View allThe Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in vers
The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_ga
SQL injection in the Media Library Assistant WordPress plugin before version 3.40 allows authenticated users with the Au
In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in David Lingre
Arbitrary file upload in the Media Library Assistant WordPress plugin (versions 3.39 and earlier) lets an authenticated
The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all ver
The Media Library Assistant plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter wit
The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type valida
Blind SQL injection in Media Library Assistant through version 3.32 allows authenticated attackers to execute arbitrary
Cross-Site Request Forgery in the Media Library Assistant WordPress plugin versions 3.35 and earlier allows remote attac
The Media Library Assistant WordPress plugin before 3.06 does not properly sanitise and escape a parameter before using
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today