Media Library Assistant: Stored cross-site scripting
The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The narrative describes the role above, while the supplied CVSS vector marks PR:H; these statements are not fully aligned. The structured affected range is < 3.44. Script execution occurs when a viewer encounters the generated shortcode links. The export does not disclose the exact vulnerable attribute or viewer role.
- Component
- Media Library Assistant
- Plugin slug
media-library-assistant- Affected
- < 3.44
- Safe version
3.44- Published
- Nov 01, 2026
This CVE was published Nov 01, 2026 and is one of 52 known issues for this plugin.
Update, patch or deactivate.
Update to a supported release containing the confirmed fix: 3.44. Validate input and escape it for the final HTML, attribute or JavaScript context; sanitize stored active content where applicable.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H