Description

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_link_attributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-11T08:16:46.647Z",
  "pubdate": "2026-09-11T08:16:46.647Z",
  "executiveSummary": "The Media Library Assistant plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability originating from the mla_link_attributes parameter.\nThis security flaw, affecting all versions up to and including 3.35, allows authenticated users with at least contributor-level privileges to inject malicious client-side scripts into the application.\nThe vulnerability arises from improper input sanitization and inadequate output escaping within the plugin's data processing routines.\nUpon successful injection, the malicious payload is persistently stored in the database and subsequently executed within the context of a victim's browser whenever they interact with the affected page.\nThis creates a high risk of unauthorized administrative actions, session hijacking, credential theft, or further client-side exploitation against authenticated users, including site administrators.\nThe attack requires valid authentication and contributor-level access, meaning an attacker must possess an established, albeit low-privileged, account to carry out the exploitation.",
  "technicalDetails": "The vulnerability resides in the Media Library Assistant plugin's handling of the mla_link_attributes parameter, which fails to adequately sanitize or escape user-supplied input prior to storing it or rendering it in the DOM.\nThis constitutes a classic Stored XSS vector. The root cause is the reliance on insecure input validation processes, which permits the inclusion of arbitrary HTML and JavaScript tags within the parameter value.\nBecause the plugin does not implement strict input filtering, an authenticated attacker can craft a payload containing malicious script tags (e.g., <script>alert(document.cookie)</script>) and supply it through the vulnerable parameter.\nUpon saving or processing the input, the plugin commits the unsanitized payload directly into the WordPress database.\nThe exploitation flow is as follows: 1) An attacker logs into the WordPress environment with contributor-level privileges or higher. 2) The attacker navigates to the plugin's configuration or utility pages where the mla_link_attributes parameter is processed. 3) The attacker submits a specially crafted request containing malicious JavaScript as the parameter value. 4) The plugin fails to validate or sanitize this input and persists it in the database. 5) When an authorized user, such as an administrator, subsequently navigates to the page or view where the stored attributes are rendered, the application echoes the malicious script into the HTML response without appropriate output encoding.\nConsequently, the attacker-supplied script executes within the security context of the victim's session. This allows for various post-exploitation activities, including but not limited to the unauthorized modification of site content, exfiltration of sensitive information stored in cookies (like session tokens), and perform arbitrary actions on behalf of the victim.\nThe scope of this vulnerability encompasses all versions of the Media Library Assistant plugin up to and including 3.35. The attack is successful provided the victim's browser parses the injected content during the rendering process, effectively bypassing intended security constraints. This flaw is inherent to the plugin's architecture, specifically within the data input-to-output pipeline where it fails to sanitize user-controlled attributes before they are reflected back to the client."
}