Media Library Assistant <= 3.35 - Reflected Cross-Site Scripting
Description
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NTechnical Details
<=3.35What Changed in the Fix
Changes introduced in v3.36
Source Code
WordPress.org SVN# Vulnerability Research Plan: CVE-2026-54198 - Media Library Assistant Reflected XSS ## 1. Vulnerability Summary The **Media Library Assistant** plugin (up to and including version 3.35) is vulnerable to **Reflected Cross-Site Scripting (XSS)**. This occurs due to improper sanitization and output …
Show full research plan
Vulnerability Research Plan: CVE-2026-54198 - Media Library Assistant Reflected XSS
1. Vulnerability Summary
The Media Library Assistant plugin (up to and including version 3.35) is vulnerable to Reflected Cross-Site Scripting (XSS). This occurs due to improper sanitization and output escaping of user-controlled parameters in the plugin's administrative pages. Specifically, parameters used for navigation and bulk actions on the Media Assistant list table (mla-menu) and the Settings pages are reflected into the HTML response without sufficient protection.
The primary vulnerable parameter identified in this research is mla_admin_action (and potentially mla_tab or s search terms) when processed by the plugin's core menu handlers in MLACore and displayed via the list table templates.
2. Attack Vector Analysis
- Endpoint:
/wp-admin/admin.php - Vulnerable Parameter:
mla_admin_action - Required Query String:
page=mla-menu - Authentication Level: Unauthenticated (Attacker), but requires an authenticated Administrator to click the malicious link.
- Preconditions: The plugin must be active. Some reflections might require specific plugin features to be enabled (e.g., "Add New Bulk Edit" in
MLAEdit).
3. Code Flow
- Entry Point: A user (Administrator) clicks a crafted link
Summary
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to 3.35 due to insufficient output escaping of user-controlled parameters and metadata fields in administrative forms. An attacker can exploit this by tricking an authenticated administrator into clicking a crafted link, resulting in the execution of arbitrary JavaScript within the administrator's browser session.
Vulnerable Code
// includes/class-mla-edit-media.php lines 644-670 // The right-hand column contains the standard and custom fields if ( !empty( $fieldset_values['post_title'] ) ) { $page_values['post_title_value'] = $fieldset_values['post_title']; } if ( !empty( $fieldset_values['post_excerpt'] ) ) { $page_values['post_excerpt_value'] = $fieldset_values['post_excerpt']; } if ( !empty( $fieldset_values['post_content'] ) ) { $page_values['post_content_value'] = $fieldset_values['post_content']; } if ( !empty( $fieldset_values['image_alt'] ) ) { $page_values['image_alt_value'] = $fieldset_values['image_alt']; } if ( !empty( $fieldset_values['post_date'] ) ) { $page_values['post_date_value'] = $fieldset_values['post_date']; } if ( !empty( $fieldset_values['post_parent'] ) ) { $page_values['post_parent_value'] = $fieldset_values['post_parent']; }
Security Fix
@@ -644,27 +648,27 @@ // The right-hand column contains the standard and custom fields if ( !empty( $fieldset_values['post_title'] ) ) { - $page_values['post_title_value'] = $fieldset_values['post_title']; + $page_values['post_title_value'] = esc_attr( $fieldset_values['post_title'] ); } if ( !empty( $fieldset_values['post_excerpt'] ) ) { - $page_values['post_excerpt_value'] = $fieldset_values['post_excerpt']; + $page_values['post_excerpt_value'] = esc_attr( $fieldset_values['post_excerpt'] ); } if ( !empty( $fieldset_values['post_content'] ) ) { - $page_values['post_content_value'] = $fieldset_values['post_content']; + $page_values['post_content_value'] = esc_attr( $fieldset_values['post_content'] ); } if ( !empty( $fieldset_values['image_alt'] ) ) { - $page_values['image_alt_value'] = $fieldset_values['image_alt']; + $page_values['image_alt_value'] = esc_attr( $fieldset_values['image_alt'] ); } if ( !empty( $fieldset_values['post_date'] ) ) { - $page_values['post_date_value'] = $fieldset_values['post_date']; + $page_values['post_date_value'] = esc_attr( $fieldset_values['post_date'] ); } if ( !empty( $fieldset_values['post_parent'] ) ) { - $page_values['post_parent_value'] = $fieldset_values['post_parent']; + $page_values['post_parent_value'] = esc_attr( $fieldset_values['post_parent'] ); } // Apply authors preset @@ -715,7 +719,7 @@ ); if ( !empty( $fieldset_values['custom_fields'][ $details['name'] ] ) ) { - $element_values['value'] = $fieldset_values['custom_fields'][ $details['name'] ]; + $element_values['value'] = esc_attr( $fieldset_values['custom_fields'][ $details['name'] ] ); } $custom_fields .= MLAData::mla_parse_template( self::$fieldset_template_array['custom_field'], $element_values );
Exploit Outline
1. Identify administrative endpoints that render bulk edit forms or settings tabs (e.g., `wp-admin/admin.php?page=mla-menu` or `wp-admin/admin.php?page=mla-settings-menu`). 2. Construct a malicious URL that includes a JavaScript payload in parameters processed by `MLAEdit::mla_get_bulk_edit_form_values` (such as `post_title`, `image_alt`, or custom field values). 3. Persuade an authenticated Administrator to click the malicious link. 4. When the page loads, the plugin reflects the payload into the HTML response as part of an input field or attribute without proper escaping (missing `esc_attr`), triggering the script execution in the Administrator's browser context.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.