---
id: "CVE-2026-113482"
kind: "vulnerability"
aliases: ["CVE-2026-113482"]
title: "Media Library Assistant WordPress plugin: shortcode attribute enables stored cross-site scripting"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["media-library-assistant", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-contributor-accounts", "plugin-at-3.44-or-later"]
published_at: "2026-11-01T05:18:57+00:00"
first_seen_at: "2026-11-01T06:48:24+00:00"
updated_at: "2026-11-01T06:48:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113482", "first_seen_at": "2026-11-01T06:48:24+00:00"}]
---

# Media Library Assistant WordPress plugin: shortcode attribute enables stored cross-site scripting

The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes when printing it inside generated links. A user with the Contributor role or higher can store script that runs in the browsers of other visitors and administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Media Library Assistant plugin in the WordPress admin under Plugins; versions before `3.44` are affected.
- Search post content for the plugin's shortcodes written by Contributor-level users, since the stored payload lives in content.

## Fix

- Media Library Assistant: move to `3.44` or later.

## Timeline

- 2026-11-01T06:48:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113482

## From the sources

The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_