CVE-2026-118095: WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows DOM-Based XSS.This issue affects Media LIbrary Assistant: from n/a through 3.42.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Media Library Assistantto a version that resolves this vulnerability.Fixed in 3.43
Event History
Frequently Asked Questions
Which plugin versions are affected?
Media Library Assistant versions through 3.42 are affected. The earliest affected version is not specified.
What access does an attacker need to exploit this issue?
The supplied CVSS vector indicates network access is sufficient to reach the vulnerable functionality, but the attacker must have low-level privileges and must persuade a user to interact with malicious content.
What impact can successful exploitation have?
Successful DOM-based XSS can affect confidentiality, integrity, and availability at a low level. The CVSS vector also indicates the impact can extend beyond the vulnerable component's security scope.