Media Library Assistant

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Media Library Assistant

Information

Software Type Plugin
Software Slug media-library-assistant (view on wordpress.org)
Software Status Active
Software Author dglingren
Software Website davidlingren.com
Software Downloads 2,707,000
Software Active Installs 70,000
Software Record Last Updated July 11, 2026

Showing 1-20 of 32 Vulnerabilities

Submit a Vulnerability
Media Library Assistant <= 3.35 - Authenticated (Contributor+) SQL Injection
6.5
CVE-2026-56012
Jun 18, 2026
Researcher: daroo
Media Library Assistant <= 3.35 - Reflected Cross-Site Scripting
6.1
CVE-2026-54198
Jun 15, 2026
Researcher: Bonds
Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form
8.1
CVE-2026-6075
May 28, 2026
Researcher: Jack Pas (Dark.)
Media Library Assistant <= 3.34 - Authenticated (Contributor+) SQL Injection
6.5
CVE-2026-34885
Apr 6, 2026
Researcher: Sajjad Haqi
Media Library Assistant <= 3.34 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-34897
Apr 6, 2026
Researcher: Sajjad Haqi
Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification
4.3
CVE-2026-3072
Mar 4, 2026
Researcher: Muhammad Sharief
Media LIbrary Assistant <= 3.32 - Authenticated (Contributor+) SQL Injection
6.5
CVE-2026-32399
Feb 20, 2026
Researcher: Doan Dinh Van (d52v)
Media Library Assistant <= 3.29 - Unauthenticated Limited File Read
5.3
CVE-2025-11738
Oct 17, 2025
Researcher: Lucas Montes (NiRoX)
Media Library Assistant <= 3.29 - Missing Authorization
5.3
CVE-2025-63065
Oct 9, 2025
Researcher: Certus Cybersecurity
Media Library Assistant <= 3.28 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2025-59590
Sep 22, 2025
Researcher: Muhammad Yudha - DJ
Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion
4.3
CVE-2025-8357
Aug 18, 2025
Researcher: wesley (wcraft)
Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes
6.4
CVE-2025-7035
Jul 15, 2025
Researcher: Muhammad Yudha - DJ
Media Library Assistant <= 3.24 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2025-31627
Mar 31, 2025
Researcher: UKO
Media Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters
6.1
CVE-2024-11974
Jan 3, 2025
Researcher: vgo0
Media Library Assistant <= 3.19 - Authenticated (Administrator+) Remote Code Execution
7.2
CVE-2024-51661
Nov 1, 2024
Researcher: Certus Cybersecurity
Media Library Assistant <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action
8.8
CVE-2024-6823
Aug 12, 2024
Researcher: wesley (wcraft)
Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting
6.1
CVE-2024-5544
Jul 1, 2024
Researcher: Le Ngoc Anh
Media Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameter
8.8
CVE-2024-5605
Jun 19, 2024
Researcher: Krzysztof Zając
Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang
6.1
CVE-2024-3519
May 21, 2024
Researcher: Le Ngoc Anh
Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode
8.8
CVE-2024-3518
May 21, 2024
Researcher: Thanh Nam Tran
Title Status CVE ID CVSS Researchers Date
Media Library Assistant <= 3.35 - Authenticated (Contributor+) SQL Injection Patched CVE-2026-56012 6.5 daroo June 18, 2026
Media Library Assistant <= 3.35 - Reflected Cross-Site Scripting Patched CVE-2026-54198 6.1 Bonds June 15, 2026
Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form Patched CVE-2026-6075 8.1 Jack Pas (Dark.) May 28, 2026
Media Library Assistant <= 3.34 - Authenticated (Contributor+) SQL Injection Patched CVE-2026-34885 6.5 Sajjad Haqi April 6, 2026
Media Library Assistant <= 3.34 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2026-34897 6.4 Sajjad Haqi April 6, 2026
Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification Patched CVE-2026-3072 4.3 Muhammad Sharief March 4, 2026
Media LIbrary Assistant <= 3.32 - Authenticated (Contributor+) SQL Injection Patched CVE-2026-32399 6.5 Doan Dinh Van (d52v) February 20, 2026
Media Library Assistant <= 3.29 - Unauthenticated Limited File Read Patched CVE-2025-11738 5.3 Lucas Montes (NiRoX) October 17, 2025
Media Library Assistant <= 3.29 - Missing Authorization Patched CVE-2025-63065 5.3 Certus Cybersecurity October 9, 2025
Media Library Assistant <= 3.28 - Authenticated (Author+) Stored Cross-Site Scripting Patched CVE-2025-59590 6.4 Muhammad Yudha - DJ September 22, 2025
Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion Patched CVE-2025-8357 4.3 wesley (wcraft) August 18, 2025
Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes Patched CVE-2025-7035 6.4 Muhammad Yudha - DJ July 15, 2025
Media Library Assistant <= 3.24 - Authenticated (Administrator+) Stored Cross-Site Scripting Patched CVE-2025-31627 4.4 UKO March 31, 2025
Media Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters Patched CVE-2024-11974 6.1 vgo0 January 3, 2025
Media Library Assistant <= 3.19 - Authenticated (Administrator+) Remote Code Execution Patched CVE-2024-51661 7.2 Certus Cybersecurity November 1, 2024
Media Library Assistant <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action Patched CVE-2024-6823 8.8 wesley (wcraft) August 12, 2024
Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting Patched CVE-2024-5544 6.1 Le Ngoc Anh July 1, 2024
Media Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameter Patched CVE-2024-5605 8.8 Krzysztof Zając June 19, 2024
Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang Patched CVE-2024-3519 6.1 Le Ngoc Anh May 21, 2024
Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode Patched CVE-2024-3518 8.8 Thanh Nam Tran May 21, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation