The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of…
The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Product
- Media Library Assistant
- Exposure class
- Web platform
- NVD status
- Received
Why it ranks 20 (Routine)
- Product class: web platform
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.