CVE-2026-6641 dglingren CVE debrief

Who should care

WordPress administrators, security teams, and users with contributor-level access or higher should assess exposure and prioritize remediation for installations using the Media Library Assistant plugin.

Why it matters

CVE-2026-6641 is a Stored Cross-Site Scripting vulnerability in the Media Library Assistant plugin for WordPress. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts, which will execute when users access injected pages. Assess exposure and prioritize remediation for WordPress installations using this plugin.

• Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts in pages.
• Injected scripts will execute whenever a user accesses an injected page.
• Remediation priority is high for WordPress installations using the Media Library Assistant plugin.

Technical summary

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up to and including 3.35. This is due to insufficient input sanitization and output escaping on the mla_link_href parameter when mla_output is set to 'paginate_links', where the _paginate_links() function processes the value through mla_process_shortcode_parameter() and _replace_query_parameter() without proper URL escaping, then outputs it directly in href attributes without applying esc_url().

Defensive priority

Assess exposure and prioritize remediation for WordPress installations using the Media Library Assistant plugin, particularly those with contributor-level access or higher.

Recommended defensive actions

• Assess exposure by checking if the Media Library Assistant plugin is installed and if the version is up to date.
• Prioritize remediation for WordPress installations using the Media Library Assistant plugin, particularly those with contributor-level access or higher.
• Consider implementing compensating controls, such as monitoring for suspicious activity or restricting access to the plugin.
• Review and apply vendor patch guidance for the Media Library Assistant plugin.
• Conduct an exposure review to identify potentially affected assets.
• Implement monitoring to detect potential exploitation attempts.
• Perform an asset inventory to identify all instances of the Media Library Assistant plugin.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up to and including 3.35. Evidence is based on CVE and NVD data. Defenders should verify installations, review vendor guidance, and assess exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.