CVE-2026-6642: Media Library Assistant WordPress XSS Vulnerability

CVE-2026-6642 is a stored XSS flaw in Media Library Assistant plugin for WordPress affecting versions up to 3.35. Attackers with Author-level access can inject malicious scripts via bulk edit presets. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-6642 Overview

CVE-2026-6642 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Media Library Assistant plugin for WordPress, affecting all versions up to and including 3.35. The flaw resides in the bulk edit preset export/import mechanism, where preset field values are rendered into HTML attribute contexts without proper escaping. Authenticated users with Author-level access (upload_files capability) can inject arbitrary scripts through crafted preset files. Execution occurs when an administrator imports the poisoned preset and the affected input field receives focus.

Critical Impact
Authenticated Author-level attackers can inject persistent JavaScript that executes in an administrator's browser session, enabling account takeover and full site compromise.

Affected Products

Media Library Assistant plugin for WordPress, versions up to and including 3.35
WordPress sites permitting Author-level (upload_files) account registration
Administrator sessions that import bulk edit preset files

Discovery Timeline

2026-09-11 - CVE-2026-6642 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-6642

Vulnerability Analysis

The vulnerability originates in the mla_generate_bulk_edit_form_fieldsets() function and the mla-bulk-edit-fieldsets.tpl template. During preset export, the plugin applies wp_kses() filtering to sanitize content for users without unfiltered_html capability. This filter targets HTML tag injection but does not block attribute-level payloads consisting of quote characters and additional HTML attributes.

When an administrator later imports the preset, the stored values are assigned directly to template variables. The template then inserts these values into the value attribute of <input> elements through simple string replacement, bypassing esc_attr(). An attacker who supplies a payload containing a closing quote and an event handler such as onfocus can break out of the attribute context and execute JavaScript in the administrator's browser.

Root Cause

The root cause is missing output escaping in an HTML attribute context. wp_kses() was applied as a sanitization boundary, but it is designed to filter tags rather than attribute-breaking characters. Values reaching the template were not passed through esc_attr() before being concatenated into value="..." markup.

Attack Vector

Exploitation requires an authenticated account with Author-level privileges or higher. The attacker crafts a bulk edit preset containing an attribute-injection payload and induces an administrator to import it. Because Scope is Changed (S:C), the script executes in the administrator's authenticated context, allowing session theft, forced configuration changes, or plugin installation. The trigger requires the target input field to receive focus, so payloads typically use the onfocus event handler.

No verified proof-of-concept code is published. For source-level details, see the WordPress Bulk Edit Template and the WordPress Edit Media Code.

Detection Methods for CVE-2026-6642

Indicators of Compromise

Bulk edit preset files containing quote characters, onfocus, onclick, or other event handler attributes within field values
Unexpected <script> execution or outbound requests originating from wp-admin pages that render bulk edit fieldsets
New administrator accounts, plugin installations, or option changes shortly after a preset import

Detection Strategies

Inspect exported preset files (JSON or serialized data) for attribute-breaking sequences such as " onfocus=
Review WordPress audit logs for upload_files-capable users creating or modifying bulk edit presets
Correlate preset import actions in the admin UI with anomalous administrator session activity

Monitoring Recommendations

Enable a WordPress activity log plugin to record preset import events and administrator actions
Monitor web server logs for POST requests to Media Library Assistant AJAX endpoints originating from non-admin roles
Alert on the creation of new administrator accounts or changes to active_plugins following preset imports

How to Mitigate CVE-2026-6642

Immediate Actions Required

Update the Media Library Assistant plugin to a version newer than 3.35 that includes WordPress Changeset #3512155
Audit all Author-level and higher accounts and remove or downgrade any that are not required
Do not import bulk edit preset files from untrusted sources until the plugin is patched

Patch Information

The vendor addressed the issue in the commit referenced by WordPress Changeset #3512155. Additional analysis is available in the Wordfence Vulnerability Report.

Workarounds

Restrict the upload_files capability to trusted users only and disable open user registration
Temporarily disable the bulk edit preset export/import functionality if patching is not immediately possible
Deploy a web application firewall rule to block requests containing attribute-breaking payloads targeting Media Library Assistant endpoints

bash

# Update Media Library Assistant via WP-CLI
wp plugin update media-library-assistant

# Verify installed version is newer than 3.35
wp plugin get media-library-assistant --field=version

# List users with upload_files capability for review
wp user list --role=author --fields=ID,user_login,user_email