Media Library Assistant CVE-2026-66601

Exploitation requires the attacker to hold at minimum a subscriber-level authenticated account on the target WordPress site, as confirmed by the CVSS PR:L metric. A second condition is that a higher-privileged user - most likely an administrator - must view the media library page or item containing the injected payload (UI:R per CVSS). Sites with open user registration are at materially higher risk because an attacker can self-register without social engineering. Exploitation is constrained by: the need for an active account on the target site, the requirement that an admin or editor view the poisoned content, and the absence of any impact if no privileged user browses the affected media library area. The A:L availability metric in the provided CVSS vector is not consistent with typical XSS impact and may reflect a scoring artifact rather than a confirmed availability consequence.

The CVSS 6.5 (Medium) score reflects the requirement for a low-privileged subscriber account (PR:L) and victim interaction (UI:R), which constrain exploitability compared to unauthenticated, no-interaction flaws. The network attack vector (AV:N) and low complexity (AC:L) indicate no special positioning or advanced technique is needed once an account is obtained. The scope change (S:C) elevates real-world impact - a subscriber could escalate effective access to administrator level by stealing session tokens. No EPSS data was supplied, no CISA KEV listing exists, and no POC code has been identified, all of which reduce immediate urgency. One anomaly to flag: the A:L availability metric in the provided CVSS vector is atypical for XSS, which does not ordinarily disrupt service availability; this should be verified against the vendor advisory. Overall, this is a genuine medium-priority issue for sites permitting open subscriber registration, but a lower priority where registration is restricted.

An attacker registers a subscriber account on a WordPress site running Media Library Assistant 3.39 or earlier, then injects a JavaScript payload into a media file metadata field processed by the plugin. When a site administrator navigates to the media library and views the affected item or page, the payload executes silently in the admin's browser, exfiltrating the session cookie to an attacker-controlled endpoint and granting full administrative access to the WordPress installation.