Live › vulnerability › CVE-2026-118095
Media Library Assistant, a WordPress plugin by David Lingren, has a DOM-based cross-site scripting flaw in versions up to 3.42. An attacker can craft a link or input that makes a visitor's browser run attacker-supplied JavaScript in the site's context.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
Sites running the Media Library Assistant WordPress plugin at version 3.42 or earlier are affected. The flaw is in client-side JavaScript, so exposure depends on the plugin's pages being reachable and visitors interacting with crafted input; sites without the plugin can skip it.
No product ranges from the sources yet.
3.42 and below listed in the source.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows DOM-Based XSS.This issue affects Media LIbrary Assistant: from n/a through 3.42.
This page as .md · .json · in your agent: get_signal("CVE-2026-118095")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.