Skip to content
Noroxi

Media Library Assistant

media-library-assistant · plugin

Known security vulnerabilities for Media Library Assistant. Find out in seconds which version runs on your site with WP Lens.

38 known vulnerabilities

3 critical · 3 with public exploit code · latest Sep 30, 2026

Vulnerabilities

  • CVE-2023-4634

    Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution

    Critical 9.8

  • CVE-2020-11928

    In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_quer

    Critical 9.8

  • CVE-2026-66600

    WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerability

    Critical 9.1

  • CVE-2024-6823

    Media Library Assistant <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action

    High 8.8

  • CVE-2024-5605

    Media Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameter

    High 8.8

  • CVE-2026-97293

    WordPress Media LIbrary Assistant plugin <= 3.41 - SQL Injection vulnerability

    High 8.5

  • CVE-2026-56012

    WordPress Media LIbrary Assistant plugin <= 3.35 - SQL Injection vulnerability

    High 8.5

  • CVE-2026-34885

    WordPress Media LIbrary Assistant plugin <= 3.34 - SQL Injection vulnerability

    High 8.5

  • CVE-2026-32399

    WordPress Media LIbrary Assistant plugin <= 3.32 - SQL Injection vulnerability

    High 8.5

  • CVE-2026-6075

    Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form

    High 8.1

  • CVE-2024-2871

    Media Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcode

    High 7.7

  • CVE-2020-11732

    The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_gallery link=download.

    High 7.5

  • CVE-2024-51661

    WordPress Media Library Assistant plugin <= 3.19 - Remote Code Execution (RCE) vulnerability

    High 7.2

  • CVE-2026-61963

    WordPress Media LIbrary Assistant plugin <= 3.38 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2026-54198

    WordPress Media LIbrary Assistant plugin <= 3.35 - Reflected Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2026-66601

    WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2026-66591

    WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2026-34897

    WordPress Media LIbrary Assistant plugin <= 3.34 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2024-3518

    Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode

    Medium 6.5

  • CVE-2026-6642

    Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import

    Medium 6.4

  • CVE-2026-6641

    Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter

    Medium 6.4

  • CVE-2026-6640

    Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter

    Medium 6.4

  • CVE-2024-11974

    Media Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters

    Medium 6.1

  • CVE-2024-3519

    Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang

    Medium 6.1

  • CVE-2023-34010

    WordPress Media Library Assistant Plugin <= 3.0.7 is vulnerable to Cross Site Scripting (XSS)

    Medium 6.1

  • CVE-2020-11731

    The Media Library Assistant plugin before 2.82 for Wordpress suffers from multiple XSS vulnerabilities in all Settings/Media Library Assista

    Medium 6.1

  • CVE-2018-20982

    The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin subme

    Medium 6.1

  • CVE-2025-59590

    WordPress Media Library Assistant Plugin <= 3.28 - Cross Site Scripting (XSS) Vulnerability

    Medium 5.9

  • CVE-2025-31627

    WordPress Media Library Assistant plugin <= 3.24 - Stored Cross Site Scripting (XSS) vulnerability

    Medium 5.9

  • CVE-2025-7035

    Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes

    Medium 5.4

  • CVE-2024-2475

    Media Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode

    Medium 5.4

  • CVE-2023-4716

    Media Library Assistant <= 3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    Medium 5.4

  • CVE-2025-63065

    WordPress Media LIbrary Assistant plugin <= 3.29 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2025-11738

    Media Library Assistant <= 3.29 - Unauthenticated Limited File Read

    Medium 5.3

  • CVE-2022-41618

    WordPress Media Library Assistant plugin <= 3.00 - Unauthenticated Error Log Disclosure vulnerability

    Medium 5.3

  • CVE-2023-24385

    WordPress Media Library Assistant Plugin <= 3.11 is vulnerable to Cross Site Scripting (XSS)

    Medium 4.8

  • CVE-2026-3072

    Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification

    Medium 4.3

  • CVE-2025-8357

    Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion

    Medium 4.3

← Back to directory