Improper neutralization of script‑related HTML tags in the Media Library Assistant plugin allows attackers to inject malicious code that can be executed in the context of the website. This basic XSS flaw can lead to session hijacking, defacement, or the execution of arbitrary client‑side scripts when users view affected pages. The impact is a loss of confidentiality and potential integrity compromise of user data, but it does not provide remote code execution on the server side.

The vulnerability affects the WordPress Media Library Assistant plugin developed by David Lingren, affecting all releases up to and including version 3.43. No specific WordPress core or other plugins are mentioned as impacted.

The CVSS score of 5.3 indicates a moderate severity for this XSS flaw. The EPSS score is not available, and it is not listed in CISA KEV, suggesting no high‑profile exploitation has been reported yet. Based on the description, the likely attack vector is external: an attacker can craft a request that injects script tags into the plugin’s output viewed by site visitors. Although the description does not state authentication requirements, the injection could potentially affect any user who can submit data through the plugin’s interface.