This vulnerability (CVE-2026-34897) involves improper neutralization of input in the Media LIbrary Assistant product by David Lingren, leading to stored cross-site scripting (CWE-79). It affects versions up to 3.34. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity, requires privileges and user interaction, and impacts confidentiality, integrity, and availability to a limited extent. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation allows an attacker with limited privileges to inject malicious scripts that are stored and executed in the context of other users' browsers, potentially leading to data disclosure, modification, or denial of service. The impact is rated medium based on the CVSS score of 6.5. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should apply strict input validation and output encoding where possible and limit privileges of users who can submit input. Monitor vendor channels for updates regarding an official fix.