Description

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up to and including 3.35. This is due to insufficient input sanitization and output escaping on the mla_link_href parameter when mla_output is set to 'paginate_links', where the _paginate_links() function processes the value through mla_process_shortcode_parameter() and _replace_query_parameter() without proper URL escaping, then outputs it directly in href attributes without applying esc_url(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-11T08:16:47.870Z",
  "pubdate": "2026-09-11T08:16:47.870Z",
  "executiveSummary": "The Media Library Assistant plugin for WordPress, in versions up to and including 3.35, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThe flaw originates from improper input sanitization and output escaping within the 'mla_gallery' shortcode, specifically targeting the 'mla_link_href' parameter when 'mla_output' is configured to 'paginate_links'.\nThis vulnerability allows an authenticated attacker with contributor-level privileges or higher to inject malicious JavaScript payloads into WordPress posts or pages.\nThe injected script executes within the context of the victim's browser session upon viewing the compromised page.\nThe primary risk implications include session hijacking, unauthorized actions performed on behalf of the victim, and potential administrative account compromise if a privileged user accesses the malicious content.\nExploitation requires the attacker to have at least contributor-level access to the WordPress environment, enabling them to place shortcodes within managed content areas.",
  "technicalDetails": "The vulnerability exists due to insufficient sanitization and validation within the 'mla_gallery' shortcode processing logic. Specifically, the 'mla_link_href' parameter is improperly handled when the 'mla_output' attribute is set to 'paginate_links'.\nThe internal _paginate_links() function fails to sanitize or validate the 'mla_link_href' input before passing it to downstream functions, including 'mla_process_shortcode_parameter()' and '_replace_query_parameter()'. These helper functions do not implement context-aware output escaping suitable for URL attributes.\nConsequently, when the shortcode is rendered, the application fails to apply the necessary esc_url() function to the 'mla_link_href' value before inserting it into an HTML 'href' attribute. This permits an attacker to inject arbitrary 'javascript:' pseudo-protocol URI schemes.\nAn attacker can exploit this by crafting a 'mla_gallery' shortcode within a page or post, embedding a payload such as [mla_gallery mla_output=\"paginate_links\" mla_link_href=\"javascript:alert('XSS')\"].\nWhen a user, such as an administrator or another contributor, accesses the page containing this shortcode, the injected script is executed by the browser because the application rendered the malicious payload directly into the DOM.\nThe attack flow follows these steps: 1) The authenticated attacker creates or modifies a page/post and inserts the malicious 'mla_gallery' shortcode. 2) The WordPress server parses the shortcode, with the plugin processing the unsanitized 'mla_link_href' parameter. 3) The plugin generates the HTML response, placing the malicious input directly into an 'href' attribute without encoding. 4) The victim's browser interprets the attribute, triggering the execution of the injected script.\nBecause the vulnerability involves Stored XSS, the payload persists in the database and executes every time a page is viewed, significantly increasing the potential for widespread impact depending on the exposure of the affected post.\nThe lack of server-side output escaping is the primary root cause, allowing for the bypass of security controls intended to prevent the injection of executable client-side code through user-supplied shortcode parameters."
}