PT-2026-134832

CVE-2026-113482

Published

2026-10-30

Updated

2026-11-01

Description by

CVSS 3.1

6.8

Medium

MetricsAV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Media Library Assistant versions prior to 3.44

Description Insufficient input sanitization and output escaping in a shortcode attribute allow authenticated users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. This occurs when the plugin fails to escape a shortcode attribute before outputting it within the attributes of generated links, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page.

Recommendations Update the plugin to version 3.44 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Karthik Ramakrishnan

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers