WordPress Media Library Assistant plugin is vulnerable to stored cross‑site scripting because it does not properly neutralize input that is later rendered in the web page. An attacker who can inject malicious payloads into the plugin’s data fields can have the script executed in the browsers of any user who views the affected content, potentially stealing credentials, defacing the site, or loading additional malware. This flaw belongs to CWE‑79.

The vulnerability affects the Media Library Assistant plugin developed by David Lingren for WordPress. All releases up to and including version 3.41 are impacted; applying the update to version 3.42 or newer removes the flaw.

With a CVSS score of 6.5 the flaw carries moderate severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, suggesting no confirmed exploit in the wild yet. However, because the vulnerability is stored, any attacker who can add or modify media metadata can embed malicious code that will be executed in the browser of every user who views that media. Exploitation requires the ability to submit input to the plugin—typically a privileged user role such as administrator or editor—though the precise prerequisite depends on how the plugin exposes its input fields. The attack vector is likely web‑based and requires the attacker to gain a route to submit content to the plugin.