Live › vulnerability › CVE-2026-113482
The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes when printing it inside generated links. A user with the Contributor role or higher can store script that runs in the browsers of other visitors and administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 06:48 UTC. All times on this page are UTC.
Sites running the Media Library Assistant plugin before version 3.44 that allow Contributor-level or higher accounts to write content. Sites without the plugin, or with it at 3.44 or later, are not affected. Sites where only trusted editors can publish have a smaller exposure.
No product ranges from the sources yet.
3.44 are affected.3.44 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
This page as .md · .json · in your agent: get_signal("CVE-2026-113482")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.