---
id: CVE-2026-113482
title: >-
  Media Library Assistant < 3.44 - Contributor+ Stored XSS via
  mla_item_parameter Shortcode Attribute
summary: >-
  The Media Library Assistant WordPress plugin before 3.44 does not escape one
  of its shortcode attributes before outputting it in an attribute of generated
  links, allowing users with the Contributor role and above to perform Stored
  Cross-…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-79
product: Media Library Assistant
affected:
  - media_library_assistant < 3.44
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-01T17:26:03.733858Z'
published: '2026-11-01'
updated: '2026-11-01'
sourceUpdated: '2026-11-01T17:34:16.056Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113482'
references:
  - url: 'https://wpscan.com/vulnerability/b01e935e-94ea-4993-8e49-2882f594bd54/'
tags:
  - cve.org
epss: 0.00235
epssPercentile: 0.14637
ingestedAt: '2026-11-05T18:28:50.790Z'
---

## Overview

The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

## Affected

- `media_library_assistant < 3.44`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.