CVE-2025-7035: Media Library Assistant XSS Vulnerability

CVE-2025-7035 Overview

CVE-2025-7035 is a stored cross-site scripting (XSS) vulnerability in the Media Library Assistant plugin for WordPress. The flaw affects all versions up to and including 3.26. It resides in the plugin's mla_tag_cloud and mla_term_list shortcodes, which fail to properly sanitize user-supplied attributes and escape output.

Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who views the affected page, including administrators. The vulnerability is tracked under [CWE-79] and was published to the National Vulnerability Database (NVD) on July 16, 2025.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft and account takeover.

Affected Products

Media Library Assistant plugin for WordPress — all versions through 3.26
Vendor: davidlingren
Affected shortcodes: mla_tag_cloud and mla_term_list

Discovery Timeline

2025-07-16 - CVE-2025-7035 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7035

Vulnerability Analysis

The Media Library Assistant plugin provides shortcodes for displaying media taxonomy information on WordPress pages and posts. The mla_tag_cloud and mla_term_list shortcodes accept user-controlled attributes that influence rendered HTML output.

The plugin processes these shortcode attributes without applying sufficient input sanitization. It also fails to escape the resulting values before writing them into the HTML response. An attacker supplies crafted attribute values containing JavaScript payloads, and the server stores and later renders them verbatim.

Because the payload is stored within post or page content, every subsequent visitor executes the attacker's script in the context of the vulnerable site. The attack requires only contributor-level privileges, a role commonly granted to external authors and freelance contributors.

Root Cause

The root cause is missing input validation and output encoding in the shortcode handlers located in class-mla-shortcode-tag-cloud.php and class-mla-shortcode-term-list.php. User-supplied shortcode attributes flow directly into the HTML output path without being passed through WordPress sanitization functions such as esc_attr() or wp_kses().

Attack Vector

Exploitation requires an authenticated session with contributor privileges or higher. The attacker creates or edits a post and inserts a malicious mla_tag_cloud or mla_term_list shortcode with attribute values containing JavaScript. When the post is published and viewed by another user, the script runs in that user's browser session.

The scope change in this vulnerability reflects that an attacker with limited privileges can affect other users, including administrators who review submitted content. Impact includes session hijacking, forced actions via the administrator session, and injection of further malicious content.

No verified public exploit code is available. See the Wordfence Vulnerability Report and the plugin source for the tag cloud shortcode for technical details.

Detection Methods for CVE-2025-7035

Indicators of Compromise

Post or page content containing [mla_tag_cloud] or [mla_term_list] shortcodes with attribute values that include <script>, onerror=, onload=, javascript:, or encoded variants.
Unexpected outbound requests from administrator browsers to attacker-controlled domains after viewing contributor-authored content.
Newly created administrator accounts or privilege changes following page views by privileged users.

Detection Strategies

Audit the WordPress wp_posts table for shortcode occurrences containing suspicious HTML or JavaScript syntax in attribute values.
Review web server access logs for POST requests to wp-admin/post.php and wp-admin/post-new.php from contributor-level accounts, correlated with shortcode use.
Enable WordPress activity logging to track post creation and edits by non-administrator roles.

Monitoring Recommendations

Monitor browser-side errors and Content Security Policy (CSP) violation reports for unexpected inline script execution on pages rendering plugin shortcodes.
Alert on authentication events for administrator accounts shortly after they review contributor-submitted content.
Track installed plugin versions across managed WordPress sites to identify instances still running Media Library Assistant 3.26 or earlier.

How to Mitigate CVE-2025-7035

Immediate Actions Required

Update the Media Library Assistant plugin to the version released after WordPress Changeset #3327861.
Audit all posts and pages that use mla_tag_cloud or mla_term_list shortcodes for malicious attribute content.
Review contributor and author accounts for unexpected activity and reset credentials for any account suspected of compromise.

Patch Information

The vendor addressed this issue in the plugin repository via WordPress Changeset #3327861. Site administrators should install the latest version available through the WordPress plugin directory. Confirm the installed version is greater than 3.26 after update.

Workarounds

Temporarily deactivate the Media Library Assistant plugin until the patched version is deployed.
Restrict contributor and author role assignments to trusted users only, and require editor review before publishing.
Deploy a web application firewall (WAF) rule that inspects shortcode attribute values for script tags and event handlers.

bash

# Update the plugin from the WordPress CLI
wp plugin update media-library-assistant

# Verify the installed version is above 3.26
wp plugin get media-library-assistant --field=version