[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpy2y7mPtIeUEy4YxHi-WfWiJ5y6h-t1v0v3g16skY9I":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-54198","media-library-assistant-reflected-cross-site-scripting-3","Media Library Assistant \u003C= 3.35 - Reflected Cross-Site Scripting","The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","media-library-assistant",null,"\u003C=3.35","3.36","medium",6.1,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-06-15 00:00:00","2026-06-23 16:00:32",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F4414cabb-765d-4ba9-be7a-acaf9ea6e45f?source=api-prod",9,[22,23,24,25,26,27,28,29],"includes\u002Fclass-mla-core.php","includes\u002Fclass-mla-edit-media.php","includes\u002Fclass-mla-image-processor.php","includes\u002Fclass-mla-mime-types.php","includes\u002Fclass-mla-objects.php","includes\u002Fclass-mla-settings-custom-fields-tab.php","includes\u002Fclass-mla-settings-image-tab.php","includes\u002Fclass-mla-settings-iptc-exif-tab.php","researched",false,3,"# Vulnerability Research Plan: CVE-2026-54198 - Media Library Assistant Reflected XSS\n\n## 1. Vulnerability Summary\nThe **Media Library Assistant** plugin (up to and including version 3.35) is vulnerable to **Reflected Cross-Site Scripting (XSS)**. This occurs due to improper sanitization and output escaping of user-controlled parameters in the plugin's administrative pages. Specifically, parameters used for navigation and bulk actions on the **Media Assistant** list table (`mla-menu`) and the **Settings** pages are reflected into the HTML response without sufficient protection. \n\nThe primary vulnerable parameter identified in this research is `mla_admin_action` (and potentially `mla_tab` or `s` search terms) when processed by the plugin's core menu handlers in `MLACore` and displayed via the list table templates.\n\n## 2. Attack Vector Analysis\n- **Endpoint**: `\u002Fwp-admin\u002Fadmin.php`\n- **Vulnerable Parameter**: `mla_admin_action`\n- **Required Query String**: `page=mla-menu`\n- **Authentication Level**: Unauthenticated (Attacker), but requires an **authenticated Administrator** to click the malicious link.\n- **Preconditions**: The plugin must be active. Some reflections might require specific plugin features to be enabled (e.g., \"Add New Bulk Edit\" in `MLAEdit`).\n\n## 3. Code Flow\n1. **Entry Point**: A user (Administrator) clicks a crafted link","The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to 3.35 due to insufficient output escaping of user-controlled parameters and metadata fields in administrative forms. An attacker can exploit this by tricking an authenticated administrator into clicking a crafted link, resulting in the execution of arbitrary JavaScript within the administrator's browser session.","\u002F\u002F includes\u002Fclass-mla-edit-media.php lines 644-670\n\t\t\u002F\u002F The right-hand column contains the standard and custom fields\n\t\tif ( !empty( $fieldset_values['post_title'] ) ) {\n\t\t\t$page_values['post_title_value'] = $fieldset_values['post_title'];\n\t\t}\n\t\t\n\t\tif ( !empty( $fieldset_values['post_excerpt'] ) ) {\n\t\t\t$page_values['post_excerpt_value'] = $fieldset_values['post_excerpt'];\n\t\t}\n\t\t\n\t\tif ( !empty( $fieldset_values['post_content'] ) ) {\n\t\t\t$page_values['post_content_value'] = $fieldset_values['post_content'];\n\t\t}\n\t\t\n\t\tif ( !empty( $fieldset_values['image_alt'] ) ) {\n\t\t\t$page_values['image_alt_value'] = $fieldset_values['image_alt'];\n\t\t}\n\t\t\n\t\tif ( !empty( $fieldset_values['post_date'] ) ) {\n\t\t\t$page_values['post_date_value'] = $fieldset_values['post_date'];\n\t\t}\n\t\t\n\t\tif ( !empty( $fieldset_values['post_parent'] ) ) {\n\t\t\t$page_values['post_parent_value'] = $fieldset_values['post_parent'];\n\t\t}","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmedia-library-assistant\u002F3.35\u002Fincludes\u002Fclass-mla-edit-media.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmedia-library-assistant\u002F3.36\u002Fincludes\u002Fclass-mla-edit-media.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmedia-library-assistant\u002F3.35\u002Fincludes\u002Fclass-mla-edit-media.php\t2024-10-18 00:27:24.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmedia-library-assistant\u002F3.36\u002Fincludes\u002Fclass-mla-edit-media.php\t2026-04-21 19:13:36.000000000 +0000\n@@ -644,27 +648,27 @@\n \n \t\t\u002F\u002F The right-hand column contains the standard and custom fields\n \t\tif ( !empty( $fieldset_values['post_title'] ) ) {\n-\t\t\t$page_values['post_title_value'] = $fieldset_values['post_title'];\n+\t\t\t$page_values['post_title_value'] = esc_attr( $fieldset_values['post_title'] );\n \t\t}\n \t\t\n \t\tif ( !empty( $fieldset_values['post_excerpt'] ) ) {\n-\t\t\t$page_values['post_excerpt_value'] = $fieldset_values['post_excerpt'];\n+\t\t\t$page_values['post_excerpt_value'] = esc_attr( $fieldset_values['post_excerpt'] );\n \t\t}\n \t\t\n \t\tif ( !empty( $fieldset_values['post_content'] ) ) {\n-\t\t\t$page_values['post_content_value'] = $fieldset_values['post_content'];\n+\t\t\t$page_values['post_content_value'] = esc_attr( $fieldset_values['post_content'] );\n \t\t}\n \t\t\n \t\tif ( !empty( $fieldset_values['image_alt'] ) ) {\n-\t\t\t$page_values['image_alt_value'] = $fieldset_values['image_alt'];\n+\t\t\t$page_values['image_alt_value'] = esc_attr( $fieldset_values['image_alt'] );\n \t\t}\n \t\t\n \t\tif ( !empty( $fieldset_values['post_date'] ) ) {\n-\t\t\t$page_values['post_date_value'] = $fieldset_values['post_date'];\n+\t\t\t$page_values['post_date_value'] = esc_attr( $fieldset_values['post_date'] );\n \t\t}\n \t\t\n \t\tif ( !empty( $fieldset_values['post_parent'] ) ) {\n-\t\t\t$page_values['post_parent_value'] = $fieldset_values['post_parent'];\n+\t\t\t$page_values['post_parent_value'] = esc_attr( $fieldset_values['post_parent'] );\n \t\t}\n \t\t\n \t\t\u002F\u002F Apply authors preset\n@@ -715,7 +719,7 @@\n \t\t\t  );\n \t\t\t  \n \t\t\t  if ( !empty( $fieldset_values['custom_fields'][ $details['name'] ] ) ) {\n-\t\t\t\t  $element_values['value'] = $fieldset_values['custom_fields'][ $details['name'] ];\n+\t\t\t\t  $element_values['value'] = esc_attr( $fieldset_values['custom_fields'][ $details['name'] ] );\n \t\t\t  }\n \n \t\t\t  $custom_fields .= MLAData::mla_parse_template( self::$fieldset_template_array['custom_field'], $element_values );","1. Identify administrative endpoints that render bulk edit forms or settings tabs (e.g., `wp-admin\u002Fadmin.php?page=mla-menu` or `wp-admin\u002Fadmin.php?page=mla-settings-menu`).\n2. Construct a malicious URL that includes a JavaScript payload in parameters processed by `MLAEdit::mla_get_bulk_edit_form_values` (such as `post_title`, `image_alt`, or custom field values).\n3. Persuade an authenticated Administrator to click the malicious link.\n4. When the page loads, the plugin reflects the payload into the HTML response as part of an input field or attribute without proper escaping (missing `esc_attr`), triggering the script execution in the Administrator's browser context.","gemini-3-flash-preview","2026-06-26 00:07:11","2026-06-26 00:08:46",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","3.35","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmedia-library-assistant\u002Ftags\u002F3.35","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmedia-library-assistant.3.35.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmedia-library-assistant\u002Ftags\u002F3.36","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmedia-library-assistant.3.36.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmedia-library-assistant\u002Ftags"]