CVE-2026-6642 is a stored cross-site scripting vulnerability in the Media Library Assistant plugin for WordPress, affecting versions up to and including 3.35. The issue occurs in the bulk edit preset export/import mechanism due to insufficient output escaping of preset field values in HTML attribute contexts within the mla_generate_bulk_edit_form_fieldsets() function and mla-bulk-edit-fieldsets.tpl template. Although wp_kses() filtering is applied during export for users without unfiltered_html capability, it does not prevent injection of quotes and HTML attributes used in the attack payload. When presets are imported, these values are assigned directly to template variables without esc_attr() escaping and inserted into input element value attributes via string replacement. Authenticated attackers with Author-level privileges (upload_files capability) can exploit this to inject arbitrary scripts that execute upon import and focus on the input field.

An attacker with Author-level access or higher can inject malicious JavaScript into the bulk edit preset import process. This script executes when an administrator imports the crafted preset and focuses on the affected input field, potentially leading to session hijacking, privilege escalation, or other malicious actions within the WordPress admin context. The vulnerability impacts confidentiality and integrity but does not affect availability.

No official patch or fix is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict Author-level user capabilities where possible and avoid importing bulk edit presets from untrusted sources. Administrators should exercise caution when importing presets and consider limiting plugin usage to trusted users only.