CVEsdglingrenCVE-2026-6640Published Sep 11, 07:39 · Updated Sep 11, 13:46 UTC
6.4
MediumCVSS 3.1 · from Wordfence
CVE-2026-6640

Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter

Media Library Assistant · Cross-site scripting · CWE-79
AffectedMedia Library Assistant
FixNo fix listed yet.
PublishedSep 11, 07:39 · Wordfence
ScoredSep 11 · 6.4 · Wordfence
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:08 UTC

What we know

No known exploitation. CISA KEV, checked 22:08 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.

Description

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_link_attributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

From Wordfence

Affected and fixed versions

ProductAffectedFixed inMedia Library Assistantup to 3.35–

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

www.wordfence.com/threat-intel/vulnerabilities/id/ac0abf8e-6efd-4cf5-ad03-8442d892a35f?source=cve · wordfence.complugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcode-tag-cloud.php#L1089-L1106 · plugins.trac.wordpress.orgplugins.trac.wordpress.org/browser/media-library-assistant/tags/3.34/includes/class-mla-shortcode-tag-cloud.php#L1089-L1106 · plugins.trac.wordpress.orgplugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcode-support.php#L270-L283 · plugins.trac.wordpress.orgplugins.trac.wordpress.org/browser/media-library-assistant/tags/3.34/includes/class-mla-shortcode-support.php#L270-L283 · plugins.trac.wordpress.orgplugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcode-tag-cloud.php#L1041-L1046 · plugins.trac.wordpress.orgplugins.trac.wordpress.org/browser/media-library-assistant/tags/3.34/includes/class-mla-shortcode-tag-cloud.php#L1041-L1046 · plugins.trac.wordpress.orgplugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcode-tag-cloud.php#L76-L95 · plugins.trac.wordpress.orgplugins.trac.wordpress.org/browser/media-library-assistant/tags/3.34/includes/class-mla-shortcode-tag-cloud.php#L76-L95 · plugins.trac.wordpress.orgplugins.trac.wordpress.org/changeset/3512155/ · plugins.trac.wordpress.org

Other CVEs in Media Library Assistant

All 18 →
4.7Media Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links · CVE-2026-103875Oct 296.4Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import · CVE-2026-6642Sep 116.4Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter · CVE-2026-6641Sep 11