Media Library Assistant CVE-2026-97294

Exploitation requires an authenticated WordPress account with at least low-level privileges (PR:L) sufficient to submit input into a Media Library Assistant field, and it requires a victim (UI:R) - typically an administrator or editor - to subsequently view the page where the stored payload renders. These two factors materially limit exploitation: an attacker cannot trigger it unauthenticated or against a passive target, so sites that restrict account registration or lower-privilege roles are substantially less exposed. The affected deployment is any site running Media Library Assistant up to and including version 3.41.

This is a stored XSS flaw (CWE-79) in the WordPress 'Media Library Assistant' plugin, rated medium severity (CVSS 6.5). The provided CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates network-reachable, low-complexity exploitation that requires an authenticated low-privilege account (PR:L) plus victim interaction (UI:R), with a scope change (S:C) reflecting that injected script executes in another user's browser context. No EPSS score, KEV listing, or public POC was supplied, so by the precision rules this is 'no public exploit identified at time of analysis.' Weighing the signals together, this is a realistic but not urgent priority: the dual requirement of a pre-existing authenticated account and a privileged victim viewing the malicious content substantially limits mass, automated exploitation, which is consistent with a medium CVSS rather than a critical one. The absence of KEV/EPSS data is a data gap, not evidence of safety - it simply means no widespread-exploitation signal is present. Patch status is a key missing signal: the affected range 'n/a through 3.41' does not confirm a fixed version in the provided data.

An attacker with a low-privilege authenticated WordPress account (e.g., author or contributor) stores a malicious script payload via a Media Library Assistant input field that is improperly neutralized. When an administrator or other user later views the affected media library page in wp-admin, the script executes in their authenticated session. No public exploit code was provided in the intelligence sources.