CVE-2026-6641 in Media Library Assistant Plugin
Summary
by MITRE • 09/11/2026
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up to and including 3.35. This is due to insufficient input sanitization and output escaping on the mla_link_href parameter when mla_output is set to 'paginate_links', where the _paginate_links() function processes the value through mla_process_shortcode_parameter() and _replace_query_parameter() without proper URL escaping, then outputs it directly in href attributes without applying esc_url(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The Media Library Assistant plugin for WordPress contains a critical security vulnerability affecting versions up through 3.35, specifically manifesting as a Stored Cross-Site Scripting flaw within the mla_gallery shortcode functionality. This vulnerability arises from insufficient input sanitization and output escaping mechanisms applied to the mla_link_href parameter under specific configuration conditions. When the plugin is configured with the mla_output setting set to paginate_links, the system invokes the _paginate_links() function which subsequently processes user-supplied data through internal helper functions such as mla_process_shortcode_parameter() and _replace_query_parameter(). These processing steps fail to adequately validate or sanitize the input before it is utilized in constructing HTML attributes. Consequently, when the resulting value is rendered into an href attribute within a web page, no proper URL escaping via WordPress core functions like esc_url() is applied. This architectural oversight allows malicious actors to inject arbitrary JavaScript code that persists on the server side and executes automatically whenever any user views the affected page containing the compromised shortcode.
From a technical perspective, this flaw represents a classic instance of improper neutralization of special elements used in an HTML tag (CWE-80), where untrusted data is inserted into a web page without adequate validation or encoding. The vulnerability specifically targets authenticated users who possess contributor-level access and above, highlighting that even lower-privilege accounts can exploit this issue to compromise the integrity of the website environment. By storing malicious scripts in the database through the shortcode parameters, attackers ensure that every subsequent visit by any user triggers the execution of these scripts within their browser context. This persistence mechanism distinguishes stored XSS from reflected variants, as the payload does not require immediate exploitation via a crafted link but remains active until manually removed or overwritten.
The operational impact of this vulnerability is severe, enabling potential session hijacking, credential theft, defacement, and redirection to malicious sites. Attackers can leverage the executed JavaScript to steal administrative cookies, impersonate legitimate users, or perform actions on behalf of victims without their knowledge. Given that WordPress powers a significant portion of the web ecosystem, such vulnerabilities pose substantial risks to both site owners and end-users interacting with compromised content. The ability for contributors to inject persistent scripts undermines trust in user-generated media libraries and can lead to widespread compromise if multiple sites are affected or if high-privilege users interact with tainted pages.
To mitigate this risk, immediate action is required by upgrading the Media Library Assistant plugin to a version that addresses these sanitization deficiencies. Developers must ensure that all dynamic content inserted into HTML attributes undergoes rigorous escaping using appropriate WordPress functions such as esc_url() for href values and other context-specific escaping methods. Input validation should be enforced at multiple layers, including parameter processing stages, to reject or neutralize potentially dangerous characters before they reach output routines. Additionally, implementing Content Security Policy headers can provide an additional layer of defense by restricting the sources from which scripts are allowed to execute, thereby reducing the impact of any successful injection attempts even if preventive measures fail. Regular security audits and adherence to secure coding standards aligned with industry benchmarks like CWE-80 will help prevent similar vulnerabilities in future updates.