CVE-2026-103875Published
Media Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links
Exact source revision recorded 29 Oct 2026 12:12:12 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-103875 · Microsoft / collected KEV context
cve-program · CVE-2026-103875
- https://www.wordfence.com/threat-intel/vulnerabilities/id/357d9d96-afb1-4b62-90cf-8d38a4cede0e?source=cve
- https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.42/includes/class-mla-shortcode-support.php#L2585
- https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.42/includes/class-mla-shortcode-support.php#L2482
- https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.42/includes/class-mla-data.php#L1548
- http://plugins.trac.wordpress.org/changeset/3760471
- https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.43/includes/class-mla-shortcode-support.php
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.