The Media Library Assistant plugin contains a flaw that allows an attacker to store malicious JavaScript code in the media library metadata fields. When a page that displays this metadata is rendered, the attacker‑inserted script executes in the user’s browser, giving the attacker the ability to steal session cookies, deface the site or redirect users to malicious sites. The underlying weakness is improper neutralization of input before it is saved and later displayed, as identified by CWE-79.

WordPress sites running the David Lingren Media Library Assistant plugin version 3.24 or earlier are affected. The vulnerability applies to all installations of the plugin regardless of WordPress core version.

The vulnerability carries a CVSS score of 5.9, indicating a moderate severity. Its EPSS score is below 1 %, suggesting low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker can submit data through the plugin’s administrative interface, which is typically available to users with author or administrator roles. In the absence of role restrictions, the flaw could be triggered by any user who can add or edit media items.