The Media Library Assistant plugin contains an input handling flaw that allows an attacker to embed malicious JavaScript in the 'search-string' parameter. When the plugin renders pagination links that contain the {+request:...+} token, the value is placed into the page without proper sanitization or escaping. As a result, an unauthenticated user can trick a victim into clicking a crafted URL, causing the victim’s browser to execute the injected script in the context of the site. This flaw permits cross‑site scripting, which may lead to cookie theft, session hijacking, defacement, or redirection of users without requiring elevated privileges.

The flaw affects the Media Library Assistant WordPress plugin, version 3.42 and earlier. Sites using a publicly accessible page that includes the [mla_gallery] shortcode with pagination enabled and a mla_link_href template that renders the {+request:...+} token are susceptible. The issue is confined to the plugin’s handling of the 'search-string' parameter; other components of WordPress are unaffected.

The CVSS score of 4.7 places this vulnerability in the medium range. The EPSS score is not available, but the lack of a publicly documented exploit and requirement for specific shortcode configuration suggest that exploitation is possible but not trivial. The vulnerability is not listed in the CISA KEV catalog, indicating no widespread active exploitation at the time of reporting. Attackers would need to host a page or link that exploits the parameter and convince a user to interact with it, after which the reflected script runs in the victim’s browser. Given the medium severity and remote attack vector, it should be treated as a potential privacy and integrity risk on affected sites.