PT-2026-134832

CVE-2026-113482

·

Published

2026-11-01

·

Updated

2026-11-01

Description by

CVSS 3.1
6.8
Medium
MetricsAV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2026-113482
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com