CVE-2026-66601

The vulnerability affects versions 3.39 and earlier of the Media Library Assistant, allowing for Subscriber-level Cross-Site Scripting (XSS) attacks. This could enable attackers to inject malicious scripts that execute in the context of a user's session, potentially compromising sensitive data. Organizations using this plugin, particularly those with subscriber access, should prioritize remediation to mitigate the risk of exploitation.