Stored Cross-Site Scripting Vulnerability in Media Library Assistant Plugin for WordPress
CVE-2025-7035
5.4MEDIUM
What is CVE-2025-7035?
The Media Library Assistant plugin for WordPress harbors a vulnerability that enables stored Cross-Site Scripting (XSS) due to inadequate input sanitization and output escaping on user-supplied attributes within its mla_tag_cloud and mla_term_list shortcodes. This vulnerability affects all versions up to and including 3.26, allowing authenticated attackers with contributor-level access or higher to inject malicious web scripts into pages. When a user accesses an affected page, these scripts execute, potentially compromising user data and site integrity.
Affected Version(s)
Media Library Assistant * <= 3.26