CVE-2026-118095

CVE-2026-118095 · WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows DOM-Based XSS.This issue affects Media LIbrary Assistant: from n/a through 3.42.

CVSS 6.5 · Medium · EPSS 0.2% · Fix available

Published: 2026-10-29T14:29:27.704Z
Updated: 2026-10-29T16:49:18.797Z

Affected products and versions

media library assistant
Versions
- ≥ 0, ≤ 3.42: Affected; ≥ 3.43: Not affected (custom)
Update to 3.43

Original sources

https://patchstack.com/database/wordpress/plugin/media-library-assistant/vulnerability/wordpress-media-library-assistant-plugin-3-42-cross-site-scripting-xss-vulnerability?_s_id=cve
https://nvd.nist.gov/vuln/detail/CVE-2026-118095

Check your server →

CVE-2026-118095 · WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability

Affected products and versions

media library assistant

Original sources