Reflected Cross-Site Scripting in Media Library Assistant for WordPress

CVE-2026-103875

What is CVE-2026-103875?

The Media Library Assistant plugin for WordPress exhibits a vulnerability that allows unauthenticated attackers to execute arbitrary web scripts through the 'search-string' parameter. This issue arises from inadequate input sanitization and output escaping in all versions up to and including 3.42. To exploit this vulnerability, an attacker must lure a user into interacting with a crafted link, typically on a publicly accessible page utilizing the [mla_gallery] shortcode in a pagination mode. The exploitation hinges on the presence of sufficient attachments to trigger pagination and the configuration of the mla_link_href template to reflect a {+request:...+} token.

References