CVE-2025-7035: 
WordPress vulnerability analysis and mitigation

CVE-2025-7035 is a Stored Cross-Site Scripting (XSS) vulnerability in the Media Library Assistant plugin for WordPress, affecting all versions up to and including 3.26. The flaw exists in the mla_tag_cloud and mla_term_list shortcodes due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on July 16, 2025, with a patch released in version 3.27. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) per NVD, and 6.4 (Medium) per ENISA/Wordfence scoring (Wordfence, RedHat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). Authenticated attackers with contributor-level access or above can embed malicious JavaScript payloads within the mla_tag_cloud or mla_term_list shortcode attributes in WordPress posts or pages. Because the plugin fails to properly sanitize inputs or escape outputs before rendering them in the browser, the injected scripts are stored server-side and execute in the context of any user who subsequently visits the affected page. The vulnerable code paths are present in class-mla-shortcodes.php, class-mla-shortcode-term-list.php, and class-mla-shortcode-tag-cloud.php (WordPress Trac, Wordfence).

Successful exploitation allows authenticated attackers (contributor role or higher) to persistently inject arbitrary JavaScript into WordPress pages, which executes in the browsers of all users who visit those pages. This can result in session cookie theft, credential harvesting, redirection to malicious sites, and manipulation of page content or functionality. While availability is not directly impacted, the confidentiality and integrity of user sessions and site content are at risk (Wordfence, RedHat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.032%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least contributor-level access, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain Contributor Access: Obtain or register a WordPress account with at least contributor-level privileges on a site running Media Library Assistant ≤ 3.26.
2. Craft Malicious Shortcode: Create or edit a post/page and insert a shortcode such as [mla_tag_cloud] or [mla_term_list] with a malicious attribute value containing a JavaScript payload (e.g., link="javascript:alert(document.cookie)" or an event handler attribute).
3. Publish or Submit Content: Submit the post for review or publish it directly. The malicious payload is stored in the WordPress database without proper sanitization.
4. Trigger Execution: When any user (including administrators) visits the page containing the injected shortcode, the plugin renders the unsanitized attribute, causing the browser to execute the injected JavaScript.
5. Achieve Objective: The executed script can steal session cookies, capture keystrokes, redirect users to phishing pages, or perform actions on behalf of the victim within the WordPress site (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing mla_tag_cloud or mla_term_list shortcodes with unusual attribute values including encoded JavaScript (e.g., <script>, javascript:, onerror=, onload=).
• Database: WordPress wp_posts table entries containing shortcodes with embedded JavaScript payloads in the post_content field.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing the affected shortcodes (indicative of data exfiltration or redirect).
• File System: No direct file system artifacts expected for stored XSS; however, monitor for newly created or modified PHP files in the plugin directory (/wp-content/plugins/media-library-assistant/) that could indicate follow-on compromise.

The vendor released version 3.27 of the Media Library Assistant plugin, which resolves the input sanitization and output escaping issues in the affected shortcodes. Site administrators should update the plugin to version 3.27 or later immediately via the WordPress admin dashboard or WP-CLI. As a temporary workaround if an immediate update is not possible, consider disabling the plugin or restricting contributor-level post creation. Additionally, audit existing pages for any mla_tag_cloud or mla_term_list shortcodes containing suspicious attribute values (WordPress Trac Changeset, Wordfence).

Wordfence, the discoverer and reporter of this vulnerability, published it in their weekly WordPress vulnerability report for the week of July 14–20, 2025, and included it in their threat intelligence feed. Sucuri also referenced the vulnerability in their July 2025 WordPress vulnerability patch roundup. No significant broader media coverage or notable researcher commentary beyond standard vulnerability disclosure channels has been observed (Wordfence Weekly Report, Sucuri Blog).