The Media Library Assistant WordPress plugin, in versions before 3.44, fails to properly escape a shortcode attribute before inserting it into the href attribute of generated links. This oversight enables users with the Contributor role or higher to store malicious JavaScript that will be executed whenever the link is rendered in a browser. The resulting vulnerability can lead to theft of user credentials, session hijacking, or further compromise of the site if the attacker injects additional payloads. The weakness aligns with the Cross‑Site Scripting category, as the attacker injects executable code into a trusted context.

Any WordPress site running Media Library Assistant prior to version 3.44 is affected. The plugin is not associated with a traditional vendor; it is distributed as a community WordPress plugin. Site administrators who have relied on the older plugin version and assigned Contributor roles to users are exposed.

While no official CVSS score is supplied, the nature of Stored XSS suggests a high severity assessment. The attack vector is not explicitly detailed in the advisory, but the description indicates that the malicious code is injected via a shortcode and surfaces when the link is rendered, implying that exploiting the vulnerability may require legitimate access to submit shortcodes. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the potential impact on confidentiality, integrity, and availability warrants rapid remediation.