The Media Library Assistant plugin for WordPress is vulnerable to stored cross‑site scripting through the mla_tag_cloud and mla_term_list shortcodes. Insufficient sanitization and escaping of user‑supplied attributes allows an attacker to inject arbitrary JavaScript that is stored and subsequently executed whenever a page containing the affected shortcode is viewed. The weakness arises from a classic input validation failure (CWE‑79).

Any WordPress site running Media Library Assistant version 3.26 or earlier, regardless of other plugins or themes, and where any user with contributor‑level or higher privileges can create or edit content that includes the vulnerable shortcodes. The vulnerability does not affect a specific WordPress core version or other plugins directly.

The CVSS score of 6.4 indicates moderate severity, but the low EPSS score (<1%) suggests that exploitation is unlikely at present. Because the attack requires authenticated contributor permissions, an attacker must have legitimate login credentials or have gained access through other means. The shortcodes can be inserted into posts or pages, and the malicious script will run for all visitors to those pages, potentially compromising user data or defacing content. The vulnerability is not listed in the CISA KEV catalog, but the impact remains significant for sites that rely on the affected shortcode functionality.