CVE-2026-66601: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in David Lingren Media LIbrary Assistant

This vulnerability (CVE-2026-66601) is a CWE-79 type cross-site scripting issue in the Media LIbrary Assistant product by David Lingren. It affects versions up to 3.39 and allows improper neutralization of input during web page generation, which could enable a subscriber with limited privileges to inject and execute malicious scripts in the context of other users. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges at the subscriber level, user interaction required, and scope changed with low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with subscriber privileges to execute arbitrary scripts in the context of other users, potentially leading to information disclosure, modification, or denial of service within the affected application. The impact is rated medium based on the CVSS score and vector.

No patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit subscriber privileges and monitor for suspicious activity related to script injection.