Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-113482

Media Library Assistant < 3.44 - Contributor+ Stored XSS via mla_item_parameter Shortcode Attribute

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Media Library Assistant

Default version status: unaffected

  • 0 to < 3.44affected

References