CVE-2026-6641: Media Library Assistant WordPress XSS Flaw

CVE-2026-6641 Overview

CVE-2026-6641 is a Stored Cross-Site Scripting (XSS) vulnerability in the Media Library Assistant plugin for WordPress. The flaw affects all versions up to and including 3.35 and resides in the mla_gallery shortcode. When mla_output is set to paginate_links, the plugin fails to properly sanitize the mla_link_href parameter before rendering it inside HTML href attributes. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes in the browser of any visitor loading the affected page. The vulnerability is classified under CWE-79.

Critical Impact
Authenticated contributors can persist JavaScript into WordPress pages, enabling session theft, administrator account takeover, and content manipulation whenever the injected page is viewed.

Affected Products

Media Library Assistant plugin for WordPress — versions up to and including 3.35
Vulnerable file: includes/class-mla-shortcode-support.php
Vulnerable file: includes/class-mla-shortcodes.php

Discovery Timeline

2026-09-11 - CVE-2026-6641 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-6641

Vulnerability Analysis

The vulnerability exists in the _paginate_links() function of the Media Library Assistant plugin. When the mla_gallery shortcode is invoked with mla_output=paginate_links, the function processes the mla_link_href parameter through mla_process_shortcode_parameter() and _replace_query_parameter(). Neither routine performs URL escaping on attacker-controlled input. The processed value is then emitted directly into an HTML href attribute without a call to esc_url().

Because the payload is stored inside post or page content, the injected script persists across page loads. Any visitor rendering the affected page, including administrators, triggers the payload in their browser session. The scope change reflected in the vector indicates the injected script executes in the context of the WordPress site rather than the attacker's origin.

Root Cause

The root cause is missing output escaping. The plugin trusts the mla_link_href shortcode attribute after internal processing and writes it into an href attribute unchanged. WordPress provides esc_url() and esc_attr() specifically for this scenario, but neither is applied on the vulnerable code paths in class-mla-shortcode-support.php at lines 2449 and 2484.

Attack Vector

An attacker requires a contributor-level WordPress account or higher. The attacker authors a post or page containing an mla_gallery shortcode configured with mla_output=paginate_links and a crafted mla_link_href value. The crafted value uses a javascript: URI or breaks out of the attribute context to inject event handlers. When a privileged user, including an editor or administrator, opens the page for review or publication, the payload executes with their session privileges.

See the Wordfence Vulnerability Analysis ID 13602 and MLA Changeset #3512155 for the patched code paths.

Detection Methods for CVE-2026-6641

Indicators of Compromise

Post or page content containing mla_gallery shortcodes with mla_output=paginate_links and unexpected mla_link_href values.
mla_link_href attribute values containing javascript:, data:, onerror=, onload=, or angle brackets.
Unexpected outbound requests from browsers of administrative users after viewing content authored by lower-privileged accounts.
New administrator accounts, modified user roles, or altered plugin and theme files created shortly after a contributor-authored page was reviewed.

Detection Strategies

Query the wp_posts table for post_content matching mla_gallery shortcodes and inspect the mla_link_href parameter for script payloads.
Enable Content Security Policy (CSP) reporting to capture inline script and javascript: URI violations on WordPress pages.
Correlate contributor-role content creation events with subsequent administrator page views in web server access logs.

Monitoring Recommendations

Alert on modifications to WordPress user roles or creation of new administrator accounts.
Monitor plugin file integrity for class-mla-shortcode-support.php and class-mla-shortcodes.php to confirm the patched version is installed.
Log and review shortcode content in draft posts submitted by contributor accounts before editorial review.

How to Mitigate CVE-2026-6641

Immediate Actions Required

Upgrade the Media Library Assistant plugin to a version later than 3.35 that includes changeset 3512155.
Audit existing posts and pages for mla_gallery shortcodes containing suspicious mla_link_href values and remove any malicious content.
Rotate session cookies and reset passwords for administrator accounts that may have viewed injected pages.
Review the WordPress user list and revoke unnecessary contributor or higher accounts.

Patch Information

The vendor fix is available in the Media Library Assistant changeset 3512155, which applies proper URL escaping to the mla_link_href parameter before it is rendered inside href attributes. Update through the WordPress plugin management console or via WP-CLI.

Workarounds

Restrict contributor and author role assignments to trusted users only until the plugin is patched.
Deploy a Web Application Firewall (WAF) rule that blocks mla_gallery shortcodes containing javascript: or event-handler attributes in the mla_link_href parameter.
Temporarily deactivate the Media Library Assistant plugin if patching is not immediately feasible.
Enforce a strict Content Security Policy that disallows inline JavaScript and javascript: URIs on the WordPress site.

bash

# Update Media Library Assistant using WP-CLI
wp plugin update media-library-assistant

# Verify installed version is above 3.35
wp plugin get media-library-assistant --field=version

# Search post content for suspicious mla_link_href values
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%mla_gallery%' AND post_content LIKE '%mla_link_href%';"