This vulnerability in Media LIbrary Assistant allows an attacker with high privileges and user interaction to inject malicious scripts that are stored and later executed when viewed by other users, due to improper input neutralization during web page generation. The vulnerability affects all versions up to 3.28. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation could lead to limited confidentiality, integrity, and availability impacts by executing arbitrary scripts in the context of affected users. This may allow attackers to perform actions on behalf of users or steal sensitive information accessible to the victim user. However, exploitation requires high privileges and user interaction, reducing the overall risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, limit exposure by restricting high-privilege user access and exercising caution with user-generated content. Monitor official channels for updates from David Lingren regarding fixes.