CVE-2026-97294: Media Library Assistant Stored XSS Vulnerability

CVE-2026-97294 Overview

CVE-2026-97294 is a stored cross-site scripting (XSS) vulnerability in the Media Library Assistant WordPress plugin by David Lingren. The flaw stems from improper neutralization of user input during web page generation [CWE-79]. All plugin versions up to and including 3.41 are affected. An authenticated attacker with low privileges can inject malicious JavaScript that persists in the application and executes in the browser context of any user who loads the affected page. The scope-changed CVSS vector indicates the injected payload can impact resources beyond the vulnerable component, including other users and the broader WordPress site.

Critical Impact
Authenticated attackers can store malicious scripts that execute in administrator browsers, enabling session theft, privilege escalation, and site takeover through administrative actions.

Affected Products

Media Library Assistant WordPress plugin by David Lingren
All versions from n/a through 3.41
WordPress sites with the plugin installed and user interaction permitted

Discovery Timeline

2026-10-07 - CVE-2026-97294 published to the National Vulnerability Database
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-97294

Vulnerability Analysis

The Media Library Assistant plugin fails to properly sanitize or encode user-supplied input before rendering it in generated web pages. This results in a stored XSS condition where attacker-controlled JavaScript persists in the WordPress database. When any authenticated user loads a page containing the injected payload, the script executes under the user's session context.

The scope-changed classification is significant. A low-privileged contributor or author account can inject payloads that compromise administrator sessions. Successful exploitation enables session hijacking, forced administrative actions, plugin manipulation, and persistence through the creation of rogue administrator accounts.

User interaction is required, as the victim must load the page containing the stored payload. However, this is trivially satisfied in a WordPress environment where administrators routinely browse media library content.

Root Cause

The root cause is missing output encoding and input sanitization in the plugin's handling of media metadata or related fields. Input reaches the response body without passing through WordPress sanitization helpers such as esc_html(), esc_attr(), or wp_kses(). The vulnerability is cataloged under CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

The attack requires network access to the WordPress admin interface and a valid low-privileged account. An attacker submits a crafted payload through an input field exposed by the plugin. The payload is stored in the database and rendered unsanitized when subsequent users view the affected page. See the Patchstack WordPress XSS Vulnerability advisory for additional technical context.

Detection Methods for CVE-2026-97294

Indicators of Compromise

Unexpected <script> tags, event handlers (onerror, onload), or javascript: URIs in media library metadata fields
New or modified WordPress administrator accounts without a corresponding admin action
Outbound requests from administrator browsers to unfamiliar domains after viewing media pages
Unusual wp_options or wp_usermeta entries containing encoded JavaScript

Detection Strategies

Audit the wp_postmeta and plugin-specific tables for HTML or JavaScript content in fields that should contain plain text
Deploy a web application firewall rule to flag XSS patterns submitted to media-library-assistant endpoints
Review web server access logs for POST requests to plugin endpoints originating from low-privilege accounts

Monitoring Recommendations

Monitor WordPress audit logs for metadata edits performed by contributor or author roles
Alert on administrator session activity that includes unexpected JavaScript execution or DOM modification
Track plugin installations, user role changes, and option modifications in near real time

How to Mitigate CVE-2026-97294

Immediate Actions Required

Update the Media Library Assistant plugin to a version later than 3.41 once the vendor publishes a fix
Restrict access to media library editing functions to trusted users only
Review existing media metadata for suspicious script content and remove any injected payloads
Rotate administrator credentials and invalidate active sessions if compromise is suspected

Patch Information

At the time of publication, the vulnerability affects versions up to and including 3.41. Monitor the Patchstack advisory and the plugin's WordPress.org page for the official patched release.

Workarounds

Disable the Media Library Assistant plugin until a patched version is available
Enforce a strict Content Security Policy (CSP) in the WordPress admin area to limit inline script execution
Reduce the number of accounts with contributor-level or higher privileges
Deploy a WordPress-aware WAF with XSS filtering enabled for plugin endpoints

bash

# Example Content Security Policy header for WordPress admin
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"