Medium severity · published Nov 1, 2026
CVE-2026-113482
Media Library Assistant < 3.44 - Contributor+ Stored XSS via mla_item_parameter Shortcode Attribute
New
6.8
CVSS
–
EPSS
No
On KEV
Description
The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ML
Media Library Assistant ·
before 3.44 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-113482
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-113482
exploit
https://wpscan.com/vulnerability/b01e935e-94ea-4993-8e49-2882f594bd54/
More from Media Library Assistant
7.2
CVE-2023-0279
Media Library Assistant < 3.06 - Admin+ SQLi
6.8
CVE-2026-16959
Media Library Assistant < 3.40 - Author+ SQL Injection via mla_search_connector
6.5
CVE-2026-113486
Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF
6.5
CVE-2026-113485
Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF
4.3
CVE-2026-113481
Media Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fields