Stored Cross-Site Scripting Vulnerability in Media Library Assistant Plugin for WordPress

CVE-2026-6641

What is CVE-2026-6641?

The Media Library Assistant plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through the 'mla_gallery' shortcode. This vulnerability arises from inadequate input sanitization and output escaping, particularly affecting the mla_link_href parameter when the mla_output is set to 'paginate_links'. The vulnerability allows authenticated attackers, with at least contributor-level access, to inject malicious web scripts, which execute when users access the compromised pages. As a result, proper precautions should be taken to mitigate risks, including upgrading to the latest plugin version and implementing strict input validation measures.

References