CVE-2026-66591: WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS.
This issue affects Media LIbrary Assistant: from n/a through 3.39.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Media LIbrary Assistant pluginto a version that resolves this vulnerability.Fixed in 3.40
Event History
Frequently Asked Questions
Which versions are affected, and is a patched version identified?
The affected versions are Media Library Assistant through 3.39. The provided data does not identify a fixed version.
What access and conditions does an attacker need to exploit this issue?
Exploitation is network-accessible and has low attack complexity, but requires low-level privileges and user interaction. The impact can extend beyond the vulnerable component because the scope is changed, with low confidentiality, integrity, and availability impact.
Is the default configuration affected, and is there a documented workaround?
The available data does not state whether the vulnerable behavior is present in the plugin's default configuration or identify any temporary mitigation. Restricting low-privilege access to the plugin until an update is available may reduce exposure, but this is not a vendor-provided mitigation in the supplied information.