CVE-2026-103875 in Media Library Assistant Plugin
Summary
by MITRE • 10/29/2026
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search-string' parameter in all versions up to, and including, 3.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted site to have a publicly accessible page containing an [mla_gallery] shortcode configured with a pagination output mode and an mla_link_href template that reflects a {+request:...+} token, along with enough attachments to trigger pagination.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The Media Library Assistant plugin for WordPress presents a significant security risk due to a reflected cross-site scripting vulnerability affecting all versions up to 3.42. This flaw stems from insufficient input sanitization and output escaping mechanisms within the application code, specifically concerning the search-string parameter. The nature of this vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages that are subsequently executed by victims who interact with maliciously crafted links. Such interactions typically involve tricking a user into clicking on a specially constructed URL that contains the injected script payload.
The exploitation of this vulnerability is contingent upon specific configuration conditions within the targeted WordPress site. The attacker must identify or configure a publicly accessible page that includes an mla_gallery shortcode. Crucially, this shortcode must be set to use a pagination output mode and incorporate an mla_link_href template that reflects a request token using the {+request:...+} syntax. Additionally, there must be enough media attachments in the library to trigger the pagination functionality. When these conditions are met, the reflected search string is rendered directly into the HTML without proper encoding, allowing the injected script to execute in the context of the victim's browser session.
From a technical classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism here is reflected XSS, where the malicious input is immediately returned by the web application in response to a request rather than being stored for later retrieval. In terms of attack tactics, this scenario maps closely to MITRE ATT&CK technique T1059, specifically sub-technique 007 which covers JavaScript execution. The attacker leverages social engineering or link manipulation to induce the victim's browser to execute the injected code, potentially leading to session hijacking, credential theft, defacement of the website content, or further malware distribution depending on the payload delivered by the script.
The operational impact of this vulnerability is severe because it requires no authentication, making it accessible to any internet user who can craft and distribute a malicious link. Once executed, the arbitrary web scripts run with the same privileges as legitimate site scripts, potentially allowing attackers to access sensitive information such as cookies, session tokens, or other data protected by Same-Origin Policy if additional vulnerabilities exist. It also enables attackers to perform actions on behalf of the authenticated user if they are logged into the WordPress admin area at the time of exploitation. This can lead to unauthorized modifications of site content, installation of backdoors, or use of the compromised server in distributed denial-of-service attacks against other targets.
Mitigation strategies should prioritize immediate remediation by upgrading the Media Library Assistant plugin to a version later than 3.42 where these input handling issues have been addressed. If an upgrade is not immediately feasible, administrators can implement temporary workarounds such as restricting access to pages containing mla_gallery shortcodes through IP whitelisting or authentication requirements if possible. Web Application Firewalls may also be configured to detect and block requests containing common XSS payloads in the search-string parameter, although this is a defensive layer rather than a fix for the underlying code flaw. Regular security audits and adherence to secure coding practices that emphasize strict input validation and output encoding are essential to prevent similar vulnerabilities in future development cycles.