Media Library Assistant
Dglingren · 18 CVEs
Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Para…
Sep 11, 2026
Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import
Sep 11, 2026
Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcod…
Sep 11, 2026
Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form
May 29, 2026
Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Mo…
Mar 5, 2026
Media Library Assistant <= 3.29 - Unauthenticated Limited File Read
Oct 18, 2025
Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion
Aug 19, 2025
Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_te…
Jul 16, 2025
Media Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofix…
Jan 4, 2025
Media Library Assistant <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX…
Aug 13, 2024
Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting
Jul 2, 2024
Media Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameter
Jun 20, 2024
Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode
May 21, 2024
Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang
May 21, 2024
Media Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcode
Apr 9, 2024
Media Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode
Mar 29, 2024
Media Library Assistant <= 3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Sep 22, 2023
Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution
Sep 6, 2023
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-6640 | Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter | MEDIUM | 0.42% | Sep 11, 2026 |
| CVE-2026-6642 | Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import | MEDIUM | 0.36% | Sep 11, 2026 |
| CVE-2026-6641 | Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter | MEDIUM | 0.36% | Sep 11, 2026 |
| CVE-2026-6075 | Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form | HIGH | 0.32% | May 29, 2026 |
| CVE-2026-3072 | Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification | MEDIUM | 0.35% | Mar 5, 2026 |
| CVE-2025-11738 | Media Library Assistant <= 3.29 - Unauthenticated Limited File Read | MEDIUM | 0.41% | Oct 18, 2025 |
| CVE-2025-8357 | Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion | MEDIUM | 0.32% | Aug 19, 2025 |
| CVE-2025-7035 | Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes | MEDIUM | 0.31% | Jul 16, 2025 |
| CVE-2024-11974 | Media Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters | MEDIUM | 0.37% | Jan 4, 2025 |
| CVE-2024-6823 | Media Library Assistant <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action | HIGH | 1.29% | Aug 13, 2024 |
| CVE-2024-5544 | Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting | MEDIUM | 0.36% | Jul 2, 2024 |
| CVE-2024-5605 | Media Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameter | HIGH | 0.58% | Jun 20, 2024 |
| CVE-2024-3518 | Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode | HIGH | 0.53% | May 21, 2024 |
| CVE-2024-3519 | Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang | MEDIUM | 0.33% | May 21, 2024 |
| CVE-2024-2871 | Media Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcode | HIGH | 0.49% | Apr 9, 2024 |
| CVE-2024-2475 | Media Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode | MEDIUM | 0.44% | Mar 29, 2024 |
| CVE-2023-4716 | Media Library Assistant <= 3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode | MEDIUM | 0.55% | Sep 22, 2023 |
| CVE-2023-4634 | Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution | CRITICAL | 85.59% | Sep 6, 2023 |
Showing 1 to 18 of 18 CVEs