CVE-2026-66601: WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability
Published Aug 20, 2026
·Updated
Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.39 versions.
Affected Software
1 affected component
WordPress Media Library Assistant<=3.39
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Media LIbrary Assistant pluginto a version that resolves this vulnerability.Fixed in 3.40
Event History
Aug 20, 2026
CVE Published
via MITRE·12:07 PM
Data Sourced
via MITRE·12:07 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The available information identifies Subscriber-level users as the attackers. Exploitation requires an account with Subscriber privileges.
2
Does exploitation require a victim to take action?
Yes. The CVSS vector includes user interaction, meaning a victim must interact with attacker-controlled content for the XSS to be triggered.
3
What impact can successful exploitation have?
The supplied CVSS vector rates confidentiality, integrity, and availability impact as low, and indicates scope can change beyond the vulnerable component.