CVE-2024-5544

The Media Library Assistant plugin for WordPress before version 3.18 contains a reflected cross-site scripting vulnerability through the order parameter. An attacker can inject malicious scripts by exploiting inadequate sanitization and escaping of user input, allowing them to execute arbitrary code in a user's browser if the user clicks a malicious link. Since no authentication is required to exploit this flaw, any unauthenticated attacker can craft and distribute such links to compromise users of the plugin.

Based on public CVE data (MITRE/NVD).