{"id":"CVE-2026-113482","kind":"vulnerability","aliases":["CVE-2026-113482"],"related":[],"title":"Media Library Assistant WordPress plugin: shortcode attribute enables stored cross-site scripting","description":"The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.","summary":"The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes when printing it inside generated links. A user with the Contributor role or higher can store script that runs in the browsers of other visitors and administrators.","severity":"medium","cvss":null,"epss":0.00153,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["media-library-assistant","package","self-hosted","wordpress"],"not_affected_if":["no-contributor-accounts","plugin-at-3.44-or-later"],"how_to_check":"- Check the installed version of the Media Library Assistant plugin in the WordPress admin under Plugins; versions before `3.44` are affected.\n- Search post content for the plugin's shortcodes written by Contributor-level users, since the stored payload lives in content.","fix":"- Media Library Assistant: move to `3.44` or later.","status":"open","published_at":"2026-11-01T05:18:57+00:00","first_seen_at":"2026-11-01T06:48:24+00:00","triaged_at":"2026-11-01T06:48:59+00:00","updated_at":"2026-11-01T16:46:41+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-01T06:48:59Z","model":"claude-haiku-5-5","output":{"fix":"- Media Library Assistant: move to `3.44` or later.","reach":"internet","title":"Media Library Assistant WordPress plugin: shortcode attribute enables stored cross-site scripting","impact":"medium","summary":"The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes when printing it inside generated links. A user with the Contributor role or higher can store script that runs in the browsers of other visitors and administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","media-library-assistant","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs scripts in visitor and administrator browsers on the site","analyst_note":"","how_to_check":"- Check the installed version of the Media Library Assistant plugin in the WordPress admin under Plugins; versions before `3.44` are affected.\n- Search post content for the plugin's shortcodes written by Contributor-level users, since the stored payload lives in content.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-at-3.44-or-later","no-contributor-accounts"],"who_is_affected":"Sites running the Media Library Assistant plugin before version 3.44 that allow Contributor-level or higher accounts to write content. Sites without the plugin, or with it at 3.44 or later, are not affected. Sites where only trusted editors can publish have a smaller exposure.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000689,"input_tokens":4102,"output_tokens":557,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113482':16A,19A '-2026':15A,18A '3.44':36B,79C 'administr':71B 'allow':97C 'assist':3A,23B,32B,75C 'attack':112C 'attribut':7A,44B,87C,93C 'browser':66B 'contributor':55B,101C 'cross':11A,109C 'cross-sit':10A,108C 'cve':14A,17A 'enabl':8A 'escap':39B,82C 'generat':49B,95C 'higher':58B 'host':27B 'insid':48B 'librari':2A,22B,31B,74C 'link':50B,96C 'media':1A,21B,30B,73C 'media-library-assist':20B 'one':40B,83C 'output':89C 'packag':24B 'perform':106C 'plugin':5A,34B,77C 'print':46B 'role':56B,102C 'run':63B 'script':13A,61B,111C 'self':26B 'self-host':25B 'shortcod':6A,43B,86C 'site':12A,110C 'store':9A,60B,107C 'user':52B,98C 'visitor':69B 'wordpress':4A,28B,33B,76C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Media Library Assistant plugin before version 3.44 that allow Contributor-level or higher accounts to write content. Sites without the plugin, or with it at 3.44 or later, are not affected. Sites where only trusted editors can publish have a smaller exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medialibraryassistant","medium","package","selfhosted","wordpress"],"first_public_at":"2026-11-01T05:18:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113482","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113482","severity":null,"published_at":"2026-11-01T05:18:57+00:00","modified_at":"2026-11-01T05:18:57+00:00","first_seen_at":"2026-11-01T06:48:24+00:00","fetched_at":"2026-11-01T06:48:24+00:00","note":null},{"source":"epss","external_id":"CVE-2026-113482","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113482","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-01T16:46:41+00:00","fetched_at":"2026-11-01T16:46:41+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}