CVE-2026-95609: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in David Lingren Media LIbrary Assistant

The vulnerability CVE-2026-95609 in Media LIbrary Assistant is a Stored Cross-site Scripting (XSS) flaw caused by improper neutralization of input during web page generation. This allows attackers to inject malicious scripts that can execute in the context of users' browsers, potentially leading to compromised confidentiality, integrity, and availability of the affected system. The affected versions include all releases from the initial version up to 3.41. The CVSS v3.1 base score is 7.1, with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed, impacting confidentiality, integrity, and availability at low levels.

Successful exploitation of this Stored XSS vulnerability can lead to execution of arbitrary scripts in the context of users visiting the affected web pages. This can result in theft of user credentials, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The CVSS score of 7.1 reflects a high severity impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation and output encoding controls as temporary mitigations to prevent injection of malicious scripts. Monitoring for suspicious activity related to XSS attacks is also advisable.