Threats tagged 'ghsa-58fv-7mj2-mxqj'

The Media Library Assistant plugin for WordPress versions up to and including 3.42 is vulnerable to reflected cross-site scripting (XSS) via the 'search-string' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation requires a publicly accessible page with an [mla_gallery] shortcode configured with pagination output mode and an mla_link_href template reflecting a {+request:...+} token, plus enough attachments to trigger pagination. The CVSS score is 4.7, indicating medium severity.