CVE case study
CVE-2026-66591: Contributor Cross-Site Scripting in Media Library Assistant
A contributor-level cross-site scripting flaw in the Media Library Assistant plugin through 3.39 let saved input execute in a privileged browser context. Version 3.40 encodes the affected output.
- Weakness
- Cross-Site Scripting (XSS)
- Affected
- Media Library Assistant 3.39 and earlier
- Remediation state
- Upgrade to Media Library Assistant 3.40 or later
- Advisory published
- 18 Aug 2026
Why it matters
Media Library Assistant extends the WordPress media library. Through version 3.39, a contributor could store input that was later rendered without output encoding, so it executed as script in a privileged browser context.
The public record scores the issue Medium at 6.5 and notes it requires a privileged user to view the affected page. Version 3.40 encodes the output.