CVE-2026-6641: Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlagallery' shortcode in versions up to and including 3.35. This is due to insufficient input sanitization and output escaping on the mlalinkhref parameter when mlaoutput is set to 'paginatelinks', where the paginatelinks() function processes the value through mlaprocessshortcodeparameter() and replacequeryparameter() without proper URL escaping, then outputs it directly in href attributes without applying escurl(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: Media Library Assistantto a version that resolves this vulnerability.Fixed in 3.35 - Configuration
Change mla_output from 'paginate_links' to a value that does not render mla_link_href into href attributes via _paginate_links(); this avoids the stored XSS path described for mla_link_href in versions up to and including 3.35.
WordPress plugin: Media Library Assistant mla_output = paginate_links
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with Contributor-level access or higher. They must be able to place a crafted mla_gallery shortcode on a page.
What shortcode configuration is required for exploitation?
The vulnerable path requires the mla_output parameter to be set to paginate_links and a malicious value supplied through the mla_link_href parameter. The value is then emitted into href attributes without proper URL escaping.
Who is affected when malicious content has been injected?
Scripts execute when a user accesses a page containing the injected shortcode. This can affect any user who visits that page, not only the contributor who created it.
How can I check whether my site is vulnerable?
Check whether the Media Library Assistant plugin version is 3.35 or earlier. Also review pages containing mla_gallery shortcodes for uses of mla_output="paginate_links" and inspect associated mla_link_href values for unexpected or suspicious content.