CVE-2026-6642 dglingren CVE debrief

Who should care

Administrators and security teams responsible for WordPress installations with the Media Library Assistant plugin should prioritize verifying and updating the plugin to prevent potential XSS attacks. They need to review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review.

Why it matters

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism. Administrators and security teams should prioritize verifying and updating the plugin to prevent potential XSS attacks.

• Attackers can inject arbitrary web scripts that execute when an administrator imports the poisoned preset and the targeted input field receives focus.
• Administrators and security teams need to verify and update the Media Library Assistant plugin to prevent potential XSS attacks.
• The vulnerability requires authenticated attackers with Author-level access and above.

Technical summary

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. This is due to insufficient output escaping on preset field values when they are rendered in HTML attribute contexts in the mla_generate_bulk_edit_form_fieldsets() function and mla-bulk-edit-fieldsets.tpl template. While wp_kses() filtering is applied during preset export for users without unfiltered_html capability, this does not prevent attribute injection attacks since the malicious payload consists of quotes and HTML attributes rather than HTML tags. When preset values are retrieved and rendered, they are directly assigned to

Defensive priority

Administrators and security teams should prioritize verifying and updating the Media Library Assistant plugin to prevent potential XSS attacks.

Recommended defensive actions

• Verify and update the Media Library Assistant plugin to the latest version.
• Restrict access to the bulk edit preset export/import mechanism.
• Monitor for suspicious activity related to the Media Library Assistant plugin.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability exists in the mla_generate_bulk_edit_form_fieldsets() function and mla-bulk-edit-fieldsets.tpl template. Authenticated attackers with Author-level access and above can inject arbitrary web scripts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.