# CVE-2026-113482: CVE-2026-113482

Status: published. Published: 2026-11-01. Updated: 2026-11-01.

The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

## Remediation

No remediation reported in collected sources

## Affected products and versions

Not reported in collected sources.

## Severity and prioritization

- CVSS 3.1: 6.8 (medium); CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H; source: NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: exploitation none; automatable no; technical impact total; source NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0

- Weaknesses: CWE-79

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://wpscan.com/vulnerability/b01e935e-94ea-4993-8e49-2882f594bd54/ (contact@wpscan.com)

## Provenance

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113482; retrieved 2026-11-02; source updated 2026-11-01

Revision: 053cff3ab1444a40fde444ea6d10a0ede6b17639be3527c21be9937692b8ccb5

Canonical: https://y2.dev/cve/CVE-2026-113482