CVE-2026-113482— Media Library Assistant < 3.44 - Contributor+ Stored XSS via mla_item_parameter Shortcode Attribute
Quick assessment
Affected
Unknown Media Library Assistant
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在版本 3.44 之前，WordPress 插件 Media Library Assistant 在将生成的链接属性输出时，未对其中的一个短代码属性进行转义处理，这使得拥有“贡献者”（Contributor）角色及以上权限的用户能够实施存储型跨站脚本（Stored XSS）攻击。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Media Library Assistant | < 3.44 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-113482
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Media Library Assistant < 3.44 - Contributor+ Stored XSS via mla_item_parameter Shortcode Attribute
Source: CVE Program / CVE List V5
Vulnerability Description
The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Media Library Assistant | 0 ~ 3.44 | - |
|
II. Public POCs for CVE-2026-113482
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-113482
请登录查看更多情报信息。
Other References for CVE-2026-113482 (1)
-
https://wpscan.com/vulnerability/b01e935e-94ea-4993-8e49-2882f594bd54/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-11-01 · 5 CVEs total
| CVE-2026-118168 | MapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address Disclosure | |
| CVE-2026-113481 | Media Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fie | |
| CVE-2026-107343 | Kali Forms < 2.4.30 - Subscriber+ Email Sending and Sender Spoofing | |
| CVE-2026-107342 | Kali Forms < 2.4.30 - Subscriber+ User Email Address Disclosure |
IV. Related Vulnerabilities
Same product: Media Library Assistant
-
CVE-2026-113481
Media Library Assistant < 3.44 - Subscriber+ Missing Authori -
CVE-2026-118095
WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Sit -
CVE-2026-103875
Media Library Assistant <= 3.42 - Reflected Cross-Site Scrip -
CVE-2026-113486
Media Library Assistant < 3.42 - Trashed Attachment Deletion -
CVE-2026-113485
Media Library Assistant < 3.42 - Bulk Attachment Deletion vi
Same vendor: Unknown
-
CVE-2026-103310
PayHere Payment Gateway 2.4.0 - 2.4.5 - Unauthenticated Paym -
CVE-2026-118168
MapPress Maps for WordPress < 2.97.15 - Unauthenticated Emai -
CVE-2026-113481
Media Library Assistant < 3.44 - Subscriber+ Missing Authori -
CVE-2026-107343
Kali Forms < 2.4.30 - Subscriber+ Email Sending and Sender S -
CVE-2026-107342
Kali Forms < 2.4.30 - Subscriber+ User Email Address Disclos