CVE-2026-6642
Received Received - Intake

Stored XSS in Media Library Assistant WordPress Plugin

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: Wordfence

Description
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. This is due to insufficient output escaping on preset field values when they are rendered in HTML attribute contexts in the mla_generate_bulk_edit_form_fieldsets() function and mla-bulk-edit-fieldsets.tpl template. While wp_kses() filtering is applied during preset export for users without unfiltered_html capability, this does not prevent attribute injection attacks since the malicious payload consists of quotes and HTML attributes rather than HTML tags. When preset values are retrieved and rendered, they are directly assigned to template variables without esc_attr() escaping and then inserted into input element value attributes via simple string replacement. This makes it possible for authenticated attackers, with Author-level access and above (upload_files capability), to inject arbitrary web scripts that execute when an administrator imports the poisoned preset and the targeted input field receives focus.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-6642
EUVD
EUVD-2026-76008

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
media_library_assistant media_library_assistant to 3.35 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Media Library Assistant WordPress plugin has a stored cross-site scripting (XSS) vulnerability in versions up to 3.35. It occurs via the bulk edit preset export/import feature. Attackers with Author-level access or higher can inject malicious scripts into preset field values. These scripts execute when an administrator imports the preset and interacts with specific input fields.

Detection Guidance

Check for the Media Library Assistant plugin versions up to and including 3.35. Inspect WordPress sites for unauthorized preset exports or imports. Look for unusual JavaScript execution in admin interfaces when presets are used.

Impact Analysis

An attacker could steal sensitive data like cookies or session tokens, perform actions on your behalf, or deface your website. Since it requires Author-level access, it primarily affects WordPress sites where untrusted users have such privileges. The impact includes potential data breaches or unauthorized changes to site content.

Compliance Impact

This vulnerability could lead to unauthorized access or data exfiltration, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations may face compliance penalties if exploited, as it undermines confidentiality and integrity controls.

Mitigation Strategies

Update the Media Library Assistant plugin to the latest version. Remove any untrusted presets. Restrict Author-level access to only necessary users. Monitor for suspicious admin activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6642. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart