CVE-2024-5544: Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order parameter in all versions up to, and including, 3.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5544?
CVE-2024-5544 is classified as a high severity vulnerability due to the potential for reflected cross-site scripting attacks.
How do I fix CVE-2024-5544?
To mitigate CVE-2024-5544, update the Media Library Assistant plugin to version 3.18 or later.
Who is affected by CVE-2024-5544?
CVE-2024-5544 affects all versions of the Media Library Assistant plugin for WordPress up to and including version 3.17.
What kind of attack does CVE-2024-5544 allow?
CVE-2024-5544 allows unauthenticated attackers to perform reflected cross-site scripting attacks via the order parameter.
What is the function of the order parameter in CVE-2024-5544?
In the context of CVE-2024-5544, the order parameter is vulnerable due to insufficient input sanitization and output escaping, enabling injection of malicious scripts.