Contributor-level stored XSS via Settings tabs

Stored XSS in Settings tabs in David Lingren Media Library Assistant before 3.40 allows remote authenticated users to inject script. The 3.40 changelog ties the flaw to five Settings tabs, indicating that contributor-supplied option values were stored and later rendered without sufficient escaping in the plugin's administrative settings views. Patchstack lists Contributor as the required privilege and user interaction as required, so exploitation depends on a lower-privileged user planting a payload that another user later loads in the WordPress admin interface.