What is the CVSS score of EUVD-2026-53958?

EUVD-2026-53958 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Media Library Assistant are affected by EUVD-2026-53958?

The Media Library Assistant WordPress plugin (versions ≤3.38) contains an unauthenticated cross-site scripting vulnerability enabling attackers to inject malicious scripts viewed by site visitors and…

How to fix or mitigate EUVD-2026-53958?

Within 24 hours: audit all WordPress installations to identify whether Media Library Assistant plugin is installed and document affected versions across the environment. Within 7 days: implement interim controls including disabling the plugin if operationally feasible, applying restrictive Web Application Firewall (WAF) rules to block suspicious requests to the plugin, or enforcing strict Content Security Policy (CSP) headers; prioritize patching WordPress core and other dependencies to reduce compound risk. Within 30 days: establish continuous monitoring of vendor security advisories for an available patch; schedule testing of patched versions in non-production environments; prepare an expedited deployment plan for immediate production rollout once a vendor patch is validated and confirmed safe.

Media Library Assistant EUVD-2026-53958

| CVE-2026-61963 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-wp9v-cvgf-5842

WordPress XSS Media Library Assistant Wordpress Plugin David Lingren

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

XSS with scope change and no auth required; availability removed as script injection does not cause measurable service disruption.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:24 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.

AnalysisAI

Unauthenticated Cross-Site Scripting (XSS) in the Media Library Assistant WordPress plugin affects all versions up to and including 3.38, allowing remote attackers without any authentication to inject malicious scripts into pages viewed by victims. The scope change indicated by the CVSS vector (S:C) suggests the injected script executes in a security context beyond the plugin itself, potentially enabling session hijacking, credential theft, or malicious redirects against authenticated WordPress users including administrators. No public exploit code or active exploitation has been confirmed at time of analysis, but the unauthenticated nature and low attack complexity elevate practical risk on exposed WordPress installations.

Technical ContextAI

Media Library Assistant is a WordPress plugin developed by David Lingren (CPE: cpe:2.3:a:david_lingren:media_library_assistant:*:*:*:*:*:*:*:*) that extends WordPress media management capabilities. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), the canonical root cause for reflected or stored XSS - meaning the plugin fails to properly sanitize or encode attacker-controlled input before rendering it in the browser DOM. The CVSS scope change (S:C) is consistent with XSS in a WordPress context where a script injected into the plugin's output can access cookies, tokens, or perform actions in the broader WordPress admin session, crossing the plugin's trust boundary into the WordPress core security context.

RemediationAI

The primary remediation is to update the Media Library Assistant plugin to a version above 3.38 via the WordPress plugin dashboard or by downloading directly from the WordPress.org plugin repository. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/media-library-assistant/vulnerability/wordpress-media-library-assistant-plugin-3-38-cross-site-scripting-xss-vulnerability should be consulted for the confirmed fixed version, as the exact patched release number is not independently confirmed in the available data. If an immediate update is not possible, a compensating control is to restrict access to any plugin pages or endpoints that accept and reflect user-supplied input using a WAF rule targeting script injection patterns, though this carries a risk of false positives affecting legitimate media library operations. Additionally, ensuring WordPress admin accounts use separate session cookies with HttpOnly and Secure flags limits the blast radius of any successful XSS exploitation.