Vulnerability record/PUBLISHED/Published Nov 1, 2026 06:00:22 UTC
CVE-2026-113482
The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedNov 1, 2026 06:00:22 UTC
PublishedNov 1, 2026 06:00:22 UTC
ReservedOct 20, 2026 08:46:33 UTC
Credits
- Karthik Ramakrishnan
- WPScan