Media Library Assistant

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Media Library Assistant

Information

Software Type Plugin
Software Slug media-library-assistant (view on wordpress.org)
Software Status Active
Software Author dglingren
Software Website davidlingren.com
Software Downloads 2,849,595
Software Active Installs 70,000
Software Record Last Updated October 13, 2026

Showing 1-20 of 43 Vulnerabilities

Submit a Vulnerability
Media Library Assistant <= 3.41 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-97294
Oct 7, 2026
Researcher: yzx001
Media Library Assistant <= 3.41 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-95609
Oct 3, 2026
Researcher: nh4tvd
Media Library Assistant <= 3.41 - Authenticated (Contributor+) SQL Injection
6.5
CVE-2026-97293
Sep 30, 2026
Researcher: Intrudify
Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import
6.4
CVE-2026-6642
Sep 10, 2026
Researcher: TruongLV1 From FPT Night Wolf
Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter
6.4
CVE-2026-6641
Sep 10, 2026
Researcher: gidget smith
Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter
6.4
CVE-2026-6640
Sep 10, 2026
Researcher: normaandersonfrank
Media Library Assistant < 3.40 - Authenticated (Author+) SQL Injection
6.5
CVE-2026-16959
Aug 24, 2026
Researcher: João Ramos Maciel
Media Library Assistant <= 3.39 - Authenticated (Author+) Arbitrary File Upload
8.8
CVE-2026-66600
Aug 19, 2026
Researcher: nh4tvd
Media Library Assistant <= 3.39 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2026-66601
Aug 19, 2026
Researcher: nh4tvd
Media Library Assistant <= 3.39 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-66591
Aug 18, 2026
Researcher: Abdullah Kareem "cyberkareem"
Media Library Assistant <= 3.38 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-61963
Aug 4, 2026
Researcher: daroo
Media Library Assistant <= 3.35 - Authenticated (Contributor+) SQL Injection
6.5
CVE-2026-56012
Jun 18, 2026
Researcher: daroo
Media Library Assistant <= 3.35 - Reflected Cross-Site Scripting
6.1
CVE-2026-54198
Jun 15, 2026
Researcher: Bonds
Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form
8.1
CVE-2026-6075
May 28, 2026
Researcher: AlexHenry
Media Library Assistant <= 3.34 - Authenticated (Contributor+) SQL Injection
6.5
CVE-2026-34885
Apr 6, 2026
Researcher: Sajjad Haqi
Media Library Assistant <= 3.34 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-34897
Apr 6, 2026
Researcher: Sajjad Haqi
Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification
4.3
CVE-2026-3072
Mar 4, 2026
Researcher: Muhammad Sharief
Media LIbrary Assistant <= 3.32 - Authenticated (Contributor+) SQL Injection
6.5
CVE-2026-32399
Feb 20, 2026
Researcher: Doan Dinh Van (d52v)
Media Library Assistant <= 3.29 - Unauthenticated Limited File Read
5.3
CVE-2025-11738
Oct 17, 2025
Researcher: Lucas Montes (NiRoX)
Media Library Assistant <= 3.29 - Missing Authorization
5.3
CVE-2025-63065
Oct 9, 2025
Researcher: Certus Cybersecurity
Title Status CVE ID CVSS Researchers Date
Media Library Assistant <= 3.41 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2026-97294 6.4 yzx001 October 7, 2026
Media Library Assistant <= 3.41 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-95609 7.2 nh4tvd October 3, 2026
Media Library Assistant <= 3.41 - Authenticated (Contributor+) SQL Injection Patched CVE-2026-97293 6.5 Intrudify September 30, 2026
Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import Patched CVE-2026-6642 6.4 TruongLV1 From FPT Night Wolf September 10, 2026
Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter Patched CVE-2026-6641 6.4 gidget smith September 10, 2026
Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter Patched CVE-2026-6640 6.4 normaandersonfrank September 10, 2026
Media Library Assistant < 3.40 - Authenticated (Author+) SQL Injection Patched CVE-2026-16959 6.5 João Ramos Maciel August 24, 2026
Media Library Assistant <= 3.39 - Authenticated (Author+) Arbitrary File Upload Patched CVE-2026-66600 8.8 nh4tvd August 19, 2026
Media Library Assistant <= 3.39 - Authenticated (Subscriber+) Stored Cross-Site Scripting Patched CVE-2026-66601 6.4 nh4tvd August 19, 2026
Media Library Assistant <= 3.39 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2026-66591 6.4 Abdullah Kareem "cyberkareem" August 18, 2026
Media Library Assistant <= 3.38 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-61963 7.2 daroo August 4, 2026
Media Library Assistant <= 3.35 - Authenticated (Contributor+) SQL Injection Patched CVE-2026-56012 6.5 daroo June 18, 2026
Media Library Assistant <= 3.35 - Reflected Cross-Site Scripting Patched CVE-2026-54198 6.1 Bonds June 15, 2026
Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form Patched CVE-2026-6075 8.1 AlexHenry May 28, 2026
Media Library Assistant <= 3.34 - Authenticated (Contributor+) SQL Injection Patched CVE-2026-34885 6.5 Sajjad Haqi April 6, 2026
Media Library Assistant <= 3.34 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2026-34897 6.4 Sajjad Haqi April 6, 2026
Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification Patched CVE-2026-3072 4.3 Muhammad Sharief March 4, 2026
Media LIbrary Assistant <= 3.32 - Authenticated (Contributor+) SQL Injection Patched CVE-2026-32399 6.5 Doan Dinh Van (d52v) February 20, 2026
Media Library Assistant <= 3.29 - Unauthenticated Limited File Read Patched CVE-2025-11738 5.3 Lucas Montes (NiRoX) October 17, 2025
Media Library Assistant <= 3.29 - Missing Authorization Patched CVE-2025-63065 5.3 Certus Cybersecurity October 9, 2025

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation