UNKNOWN NVD

CVE-2026-113482

The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links

The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

References

https://wpscan.com/vulnerability/b01e935e-94ea-4993-8e49-2882f594bd54/

Published: 2026-11-01 · Source: NVD · Feed updated: 2026-11-01

This unknown severity vulnerability was published on 2026-11-01 via NVD.

vulnfeed aggregates 15187 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.