{"id":"CVE-2026-119496","kind":"vulnerability","aliases":["CVE-2026-119496"],"related":[],"title":"Media Library Assistant WordPress plugin: script injection through web page tags","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Code Injection.This issue affects Media LIbrary Assistant: from n/a through 3.43.","summary":"The Media Library Assistant plugin for WordPress, by David Lingren, fails to neutralize script-related HTML tags, which is a cross-site scripting flaw. An attacker can inject code that runs in the browser of a visitor or administrator who views the affected page.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["media-library-assistant","runtime","wordpress"],"not_affected_if":["fixed-version","plugin-not-installed"],"how_to_check":"- Check the installed version of Media Library Assistant in the WordPress admin plugin list, or in `wp-content/plugins/media-library-assistant/`.\n- Treat any version through `3.43` as affected.","fix":"- Move to a version later than `3.43`; the sources do not name the exact fixed release.","status":"open","published_at":"2026-11-07T11:16:58+00:00","first_seen_at":"2026-11-07T11:46:52+00:00","triaged_at":"2026-11-07T11:48:34+00:00","updated_at":"2026-11-07T11:48:34+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-07T11:48:34Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version later than `3.43`; the sources do not name the exact fixed release.","reach":"internet","title":"Media Library Assistant WordPress plugin: script injection through web page tags","impact":"medium","summary":"The Media Library Assistant plugin for WordPress, by David Lingren, fails to neutralize script-related HTML tags, which is a cross-site scripting flaw. An attacker can inject code that runs in the browser of a visitor or administrator who views the affected page.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","media-library-assistant"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitor or admin browsers on the site","analyst_note":"Confirm the fixed version and whether unauthenticated input reaches the vulnerable page, using the NVD entry and the plugin's changelog.","how_to_check":"- Check the installed version of Media Library Assistant in the WordPress admin plugin list, or in `wp-content/plugins/media-library-assistant/`.\n- Treat any version through `3.43` as affected.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","fixed-version"],"who_is_affected":"Sites running the Media Library Assistant WordPress plugin at version 3.43 or earlier are exposed. The flaw is in how the plugin handles HTML tags in web pages, so the risk is highest where untrusted users can submit content that is rendered. Sites that do not run the plugin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000717,"input_tokens":4234,"output_tokens":588,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119496':14A,17A '-2026':13A,16A '3.43':106C 'administr':64B 'affect':68B,99C 'allow':95C 'assist':3A,21B,27B,90C,94C,102C 'attack':51B 'basic':82C 'browser':59B 'code':54B,96C 'cross':46B 'cross-sit':45B 'cve':12A,15A 'david':32B,86C 'fail':34B 'flaw':49B 'html':40B,76C 'improp':70C 'inject':7A,53B 'injection.this':97C 'issu':98C 'librari':2A,20B,26B,89C,93C,101C 'lingren':33B,87C 'media':1A,19B,25B,88C,92C,100C 'media-library-assist':18B,91C 'n/a':104C 'neutral':36B,71C 'page':10A,69B,81C 'plugin':5A,28B 'relat':39B,75C 'run':56B 'runtim':22B 'script':6A,38B,48B,74C 'script-rel':37B,73C 'site':47B 'tag':11A,41B,77C 'view':66B 'visitor':62B 'vulner':84C 'web':9A,80C 'wordpress':4A,23B,30B 'xss':83C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Media Library Assistant WordPress plugin at version 3.43 or earlier are exposed. The flaw is in how the plugin handles HTML tags in web pages, so the risk is highest where untrusted users can submit content that is rendered. Sites that do not run the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medialibraryassistant","medium","runtime","wordpress"],"campaign_type":null,"search_a":"'-119496':14A,17A '-2026':13A,16A 'assist':3A 'cve':12A,15A 'inject':7A 'librari':2A 'media':1A 'page':10A 'plugin':5A 'script':6A 'tag':11A 'web':9A 'wordpress':4A","search_b":"'administr':64B 'affect':68B 'assist':21B,27B 'attack':51B 'browser':59B 'code':54B 'cross':46B 'cross-sit':45B 'david':32B 'fail':34B 'flaw':49B 'html':40B 'inject':53B 'librari':20B,26B 'lingren':33B 'media':19B,25B 'media-library-assist':18B 'neutral':36B 'page':69B 'plugin':28B 'relat':39B 'run':56B 'runtim':22B 'script':38B,48B 'script-rel':37B 'site':47B 'tag':41B 'view':66B 'visitor':62B 'wordpress':23B,30B","search_c":"'3.43':106C 'affect':99C 'allow':95C 'assist':90C,94C,102C 'basic':82C 'code':96C 'david':86C 'html':76C 'improp':70C 'injection.this':97C 'issu':98C 'librari':89C,93C,101C 'lingren':87C 'media':88C,92C,100C 'media-library-assist':91C 'n/a':104C 'neutral':71C 'page':81C 'relat':75C 'script':74C 'script-rel':73C 'tag':77C 'vulner':84C 'web':80C 'xss':83C","first_public_at":"2026-11-07T11:16:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119496","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119496","severity":null,"published_at":"2026-11-07T11:16:58+00:00","modified_at":"2026-11-07T11:16:58+00:00","first_seen_at":"2026-11-07T11:46:52+00:00","fetched_at":"2026-11-07T11:46:52+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}