CVE-2026-103875: Media Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links

Q: Which sites are exposed to exploitation?

Exposure requires a publicly accessible page containing an [mla_gallery] shortcode configured for pagination output, with an mla_link_href template that reflects a {+request:...+} token. The gallery must also have enough attachments for pagination to be triggered.

Q: Does an attacker need an account or administrative access?

No. The issue can be exploited by an unauthenticated attacker, but they must persuade a user to perform an action such as clicking a crafted link.

Q: What can be done if updating is not immediately possible?

Remove or restrict public access to affected gallery pages, or change the shortcode configuration so pagination is not used or the mla_link_href template does not reflect a {+request:...+} token. Pages without enough attachments to trigger pagination do not meet the stated exploitation conditions.

Q: How can I identify potentially affected pages?

Review publicly accessible WordPress content for [mla_gallery] shortcodes and inspect their pagination settings and mla_link_href templates. Prioritize pages whose templates contain {+request:...+} and whose galleries contain enough attachments to display pagination.

Published Oct 29, 2026

Updated

The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search-string' parameter in all versions up to, and including, 3.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted site to have a publicly accessible page containing an [mlagallery] shortcode configured with a pagination output mode and an mlalinkhref template that reflects a {+request:...+} token, along with enough attachments to trigger pagination.

Affected Software

1 affected component

David J. Roth Media Library Assistant<=3.42

Event History

Oct 29, 2026

CVE Published

via MITRE·09:25 AM

Data Sourced

via MITRE·09:25 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which sites are exposed to exploitation?

Exposure requires a publicly accessible page containing an [mla_gallery] shortcode configured for pagination output, with an mla_link_href template that reflects a {+request:...+} token. The gallery must also have enough attachments for pagination to be triggered.

Does an attacker need an account or administrative access?

No. The issue can be exploited by an unauthenticated attacker, but they must persuade a user to perform an action such as clicking a crafted link.

What can be done if updating is not immediately possible?

Remove or restrict public access to affected gallery pages, or change the shortcode configuration so pagination is not used or the mla_link_href template does not reflect a {+request:...+} token. Pages without enough attachments to trigger pagination do not meet the stated exploitation conditions.

How can I identify potentially affected pages?

Review publicly accessible WordPress content for [mla_gallery] shortcodes and inspect their pagination settings and mla_link_href templates. Prioritize pages whose templates contain {+request:...+} and whose galleries contain enough attachments to display pagination.

CVE-2026-103875: Media Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links

Affected Software

Event History

Frequently Asked Questions

Which sites are exposed to exploitation?

Does an attacker need an account or administrative access?

What can be done if updating is not immediately possible?

How can I identify potentially affected pages?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to exploitation?

Does an attacker need an account or administrative access?

What can be done if updating is not immediately possible?

How can I identify potentially affected pages?