CVE-2024-2475 in Media Library Assistant Plugin
Summary
by MITRE • 03/29/2024
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/13/2026
The Media Library Assistant plugin for WordPress presents a critical stored cross-site scripting vulnerability that affects all versions up to and including 3.13. This vulnerability stems from inadequate input sanitization and output escaping mechanisms within the plugin's shortcode implementation, creating a persistent security risk that can be exploited by authenticated attackers possessing contributor-level privileges or higher. The flaw allows malicious actors to inject arbitrary web scripts into pages through manipulated shortcode attributes, which then execute whenever any user accesses those compromised pages.
The technical nature of this vulnerability places it firmly within the scope of CWE-79 - Improper Neutralization of Input During Web Page Generation, which specifically addresses the failure to properly sanitize user-supplied data before incorporating it into web page content. This weakness enables attackers to bypass standard security controls by embedding malicious scripts within legitimate plugin functionality. The vulnerability operates as a stored XSS attack because the malicious code is permanently stored within the application's database rather than being executed through a single request, making it particularly dangerous as it can affect multiple users over extended periods.
Attackers with contributor-level access or higher can leverage this vulnerability to execute arbitrary JavaScript code within the context of any user's browser who visits pages containing the injected malicious shortcodes. This creates a significant operational impact as it allows for session hijacking, credential theft, data exfiltration, and potential lateral movement within the compromised WordPress environment. The vulnerability is particularly concerning because it requires minimal privileges to exploit, making it accessible to users who normally have limited administrative capabilities. The stored nature of the attack means that once the malicious code is injected, it can persist across multiple user sessions and visits, amplifying the potential damage.
The operational impact extends beyond immediate script execution to include potential privilege escalation and persistent backdoor establishment within the WordPress environment. An attacker could inject scripts that redirect users to malicious domains, steal cookies and session tokens, or even modify content in ways that could compromise the integrity of the entire website. This vulnerability represents a significant threat to WordPress sites that rely on the Media Library Assistant plugin, particularly those with multiple contributors or users who may inadvertently click on compromised content. The attack vector is particularly insidious because it leverages legitimate plugin functionality to deliver malicious payloads, making detection more difficult.
Organizations should implement immediate mitigations including updating to the latest version of the Media Library Assistant plugin where the vulnerability has been addressed, implementing strict input validation on all user-supplied data, and conducting thorough security reviews of all plugin installations. The remediation process should also include monitoring for any signs of exploitation attempts and implementing web application firewalls to detect and block suspicious shortcode parameters. Additionally, administrators should consider role-based access controls to minimize the potential impact of compromised accounts and ensure that all users with contributor-level privileges or higher undergo security training to recognize potential attack vectors. This vulnerability demonstrates the critical importance of proper input sanitization and output escaping in web applications, aligning with ATT&CK technique T1566.001 - Phishing: Spearphishing Attachment, as attackers may use this vulnerability to deliver malicious content through seemingly legitimate plugin functionality.