Description

Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.39 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-20T12:16:33.933Z",
  "pubdate": "2026-08-20T12:16:33.933Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the Media Library Assistant plugin for WordPress, specifically affecting versions 3.39 and prior.\nThe flaw allows authenticated users with subscriber-level privileges to inject and execute arbitrary client-side scripts, such as JavaScript, within the context of other users' browser sessions when they interact with vulnerable administrative or frontend interfaces.\nThe primary impact of this vulnerability includes session hijacking, unauthorized actions performed on behalf of higher-privileged administrators, and potential compromise of the WordPress application.\nRisk implications are moderate to high depending on the privileges of the targeted victim, as successful exploitation could lead to full site takeover if an administrator views the malicious payload.\nAttacker capabilities require authenticated access at the subscriber level to input crafted payloads into vulnerable parameters processed by the Media Library Assistant plugin.\nExploitation requirements include a valid subscriber account on the target WordPress instance and social engineering or direct interaction from a higher-privileged user to trigger the stored or reflected script execution.",
  "technicalDetails": "The root cause of this vulnerability stems from insufficient input sanitization and inadequate output encoding within the Media Library Assistant plugin <= 3.39 versions.\nWhen handling user-supplied data submitted via HTTP requests, the application fails to properly neutralize special characters such as angle brackets (< and >) and quotation marks, allowing malicious HTML and JavaScript payloads to be reflected or stored.\nThe vulnerable component resides within the input processing routines of the Media Library Assistant plugin, which improperly validate parameters before rendering them in the Document Object Model (DOM).\nAuthentication requirements dictate that the attacker must possess at least subscriber-level privileges to initiate requests that inject the malicious payload into the application.\nPrivilege requirements are low for the initial injection phase, categorized under subscriber access, but the resulting execution can impact administrators and editors if the payload is rendered in their administrative context.\nNetwork exposure is standard for web applications running WordPress, accessible via HTTP/HTTPS protocols over the network.\nThe attack flow begins when an authenticated subscriber crafts an HTTP request containing malicious JavaScript within vulnerable input fields handled by the Media Library Assistant plugin.\nUpon receiving the request, the plugin fails to sanitize the input and incorporates the malicious string into the application response or database.\nWhen a victim with higher privileges accesses the affected interface, the browser parses the unescaped payload as executable script content rather than inert text data.\nPayload behavior involves executing arbitrary JavaScript in the victim's browser session, granting the attacker the ability to interact with the DOM, steal session cookies, capture authentication tokens, or perform unauthorized administrative actions via the WordPress REST API or AJAX endpoints.\nPost-exploitation impact includes unauthorized creation of rogue administrator accounts, modification of core application files or database records, and complete compromise of the affected WordPress installation."
}