Media Library Assistant

Уязвимости

• CVE-2023-4634без авторизации≤ 3.09

  Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution

  Критич. 9.8

• CVE-2020-11928без авторизации

  In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_quer

  Критич. 9.8

• CVE-2026-66600автор+≤ 3.39

  WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerability

  Критич. 9.1

• CVE-2024-6823автор+≤ 3.18

  Media Library Assistant <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action

  Высокий 8.8

• CVE-2024-5605участник+≤ 3.16

  Media Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameter

  Высокий 8.8

• CVE-2026-56012нужен вход≤ 3.35

  WordPress Media LIbrary Assistant plugin <= 3.35 - SQL Injection vulnerability

  Высокий 8.5

• CVE-2026-34885нужен вход≤ 3.34

  WordPress Media LIbrary Assistant plugin <= 3.34 - SQL Injection vulnerability

  Высокий 8.5

• CVE-2026-32399нужен вход≤ 3.32

  WordPress Media LIbrary Assistant plugin <= 3.32 - SQL Injection vulnerability

  Высокий 8.5

• CVE-2026-97293участник+≤ 3.41

  WordPress Media LIbrary Assistant plugin <= 3.41 - SQL Injection vulnerability

  Высокий 8.5

• CVE-2026-6075без авторизации · нужен клик≤ 3.35

  Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form

  Высокий 8.1

• CVE-2024-2871участник+≤ 3.13

  Media Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcode

  Высокий 7.7

• CVE-2020-11732без авторизации

  The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_gallery link=download.

  Высокий 7.5

• CVE-2024-51661высокие права≤ 3.19

  WordPress Media Library Assistant plugin <= 3.19 - Remote Code Execution (RCE) vulnerability

  Высокий 7.2

• CVE-2026-61963без авторизации · нужен клик≤ 3.38

  WordPress Media LIbrary Assistant plugin <= 3.38 - Cross Site Scripting (XSS) vulnerability

  Высокий 7.1

• CVE-2026-54198без авторизации · нужен клик≤ 3.35

  WordPress Media LIbrary Assistant plugin <= 3.35 - Reflected Cross Site Scripting (XSS) vulnerability

  Высокий 7.1

• CVE-2026-66601подписчик+≤ 3.39

  WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability

  Средний 6.5

• CVE-2026-66591нужен вход≤ 3.39

  WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability

  Средний 6.5

• CVE-2026-34897нужен вход≤ 3.34

  WordPress Media LIbrary Assistant plugin <= 3.34 - Cross Site Scripting (XSS) vulnerability

  Средний 6.5

• CVE-2024-3518участник+≤ 3.15

  Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode

  Средний 6.5

• CVE-2026-6642автор+≤ 3.35

  Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import

  Средний 6.4

• CVE-2026-6641участник+≤ 3.35

  Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter

  Средний 6.4

• CVE-2026-6640участник+≤ 3.35

  Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter

  Средний 6.4

• CVE-2024-11974без авторизации · нужен клик≤ 3.23

  Media Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters

  Средний 6.1

• CVE-2024-3519без авторизации · нужен клик≤ 3.15

  Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang

  Средний 6.1

• CVE-2023-34010без авторизации · нужен клик≤ 3.0.7

  WordPress Media Library Assistant Plugin <= 3.0.7 is vulnerable to Cross Site Scripting (XSS)

  Средний 6.1

• CVE-2018-20982без авторизации · нужен клик

  The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin subme

  Средний 6.1

• CVE-2020-11731нужен вход

  The Media Library Assistant plugin before 2.82 for Wordpress suffers from multiple XSS vulnerabilities in all Settings/Media Library Assista

  Средний 6.1

• CVE-2025-59590высокие права≤ 3.28

  WordPress Media Library Assistant Plugin <= 3.28 - Cross Site Scripting (XSS) Vulnerability

  Средний 5.9

• CVE-2025-31627высокие права≤ 3.24

  WordPress Media Library Assistant plugin <= 3.24 - Stored Cross Site Scripting (XSS) vulnerability

  Средний 5.9

• CVE-2025-7035участник+≤ 3.26

  Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes

  Средний 5.4

• CVE-2024-2475участник+≤ 3.13

  Media Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode

  Средний 5.4

• CVE-2023-4716участник+≤ 3.10

  Media Library Assistant <= 3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

  Средний 5.4

• CVE-2025-63065без авторизации≤ 3.29

  WordPress Media LIbrary Assistant plugin <= 3.29 - Broken Access Control vulnerability

  Средний 5.3

• CVE-2025-11738без авторизации≤ 3.29

  Media Library Assistant <= 3.29 - Unauthenticated Limited File Read

  Средний 5.3

• CVE-2022-41618без авторизации≤ 3.00

  WordPress Media Library Assistant plugin <= 3.00 - Unauthenticated Error Log Disclosure vulnerability

  Средний 5.3

• CVE-2023-24385автор+≤ 3.11

  WordPress Media Library Assistant Plugin <= 3.11 is vulnerable to Cross Site Scripting (XSS)

  Средний 4.8

• CVE-2026-3072подписчик+≤ 3.33

  Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification

  Средний 4.3

• CVE-2025-8357автор+≤ 3.27

  Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion

  Средний 4.3