CVE-2026-6642: Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. This is due to insufficient output escaping on preset field values when they are rendered in HTML attribute contexts in the mlageneratebulkeditformfieldsets() function and mla-bulk-edit-fieldsets.tpl template. While wpkses() filtering is applied during preset export for users without unfilteredhtml capability, this does not prevent attribute injection attacks since the malicious payload consists of quotes and HTML attributes rather than HTML tags. When preset values are retrieved and rendered, they are directly assigned to template variables without escattr() escaping and then inserted into input element value attributes via simple string replacement. This makes it possible for authenticated attackers, with Author-level access and above (uploadfiles capability), to inject arbitrary web scripts that execute when an administrator imports the poisoned preset and the targeted input field receives focus.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/plugin/media-library-assistantto a version that resolves this vulnerability.Fixed in 3.35 - Configuration
Apply output escaping for preset field values in mla_generate_bulk_edit_form_fieldsets() and the mla-bulk-edit-fieldsets.tpl template so values rendered into input element value attributes are escaped (e.g., use esc_attr() rather than direct assignment/string replacement without escaping).
WordPress (Media Library Assistant) mla_generate_bulk_edit_form_fieldsets() preset field rendering = escape preset values with esc_attr() when inserted into HTML attribute contexts
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Author-level access or higher can exploit it, provided they have the upload_files capability. The attacker can create a malicious bulk edit preset for an administrator to import.
What user interaction is required for the payload to execute?
An administrator must import the poisoned bulk edit preset, and the targeted input field must receive focus. The injected script executes in the administrator's browser when that condition is met.
Does filtering preset exports with wp_kses() prevent exploitation?
No. The described attack uses quotes and HTML attributes to inject content into an input value attribute, rather than relying on HTML tags that wp_kses() would remove.
Which versions are affected?
Media Library Assistant versions up to and including 3.35 are affected.