The Media Library Assistant plugin for WordPress gains a Stored Cross‑Site Scripting flaw through the bulk edit preset export and import process in versions up through 3.35. During export, payloads containing quotes and HTML attribute fragments bypass WordPress’s wp_kses() filter because they do not form full tags. When an administrator later imports the same preset, the plugin injects the raw preset values directly into input value attributes without esc_attr() escaping, causing the malicious script to run in the administrator’s browser when the input field receives focus.

Any WordPress installation running Media Library provided a user with Author or higher capability (e.g., upload_files capability) can create and export preset data. The flaw is only exploitable by authorized users who subsequently trigger the import with an administrator’s session.

The vulnerability carries a CVSS score of 6.4, reflecting moderate severity. No EPSS value is available, so the exploitation probability is not quantified. The flaw is not listed in the CISA KEV catalog. Attackers need authenticated access with at least Author privileges to craft and export a malicious preset and then rely on an administrator to import it; the payload executes inside the admin interface, potentially allowing for data theft or defacement of the site.