Media Library Assistant

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Media Library Assistant

Information

Software Type Plugin
Software Slug media-library-assistant (view on wordpress.org)
Software Status Active
Software Author dglingren
Software Website davidlingren.com
Software Downloads 2,782,241
Software Active Installs 70,000
Software Record Last Updated September 7, 2026

Showing 1-20 of 37 Vulnerabilities

Submit a Vulnerability
Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification
4.3
CVE-2026-3072
Mar 4, 2026
Researcher: Muhammad Sharief
Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion
4.3
CVE-2025-8357
Aug 18, 2025
Researcher: wesley (wcraft)
Media Library Assistant <= 3.24 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2025-31627
Mar 31, 2025
Researcher: UKO
Media Library Assistant <= 3.29 - Unauthenticated Limited File Read
5.3
CVE-2025-11738
Oct 17, 2025
Researcher: Lucas Montes (NiRoX)
Media Library Assistant <= 3.29 - Missing Authorization
5.3
CVE-2025-63065
Oct 9, 2025
Researcher: Certus Cybersecurity
Media Library Assistant <= 3.00 - Information Disclosure
5.3
CVE-2022-41618
Sep 29, 2022
Researcher: Brandon James Roldan (tomorrowisnew)
Media Library Assistant <= 3.35 - Reflected Cross-Site Scripting
6.1
CVE-2026-54198
Jun 15, 2026
Researcher: Bonds
Media Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters
6.1
CVE-2024-11974
Jan 3, 2025
Researcher: vgo0
Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting
6.1
CVE-2024-5544
Jul 1, 2024
Researcher: Le Ngoc Anh
Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang
6.1
CVE-2024-3519
May 21, 2024
Researcher: Le Ngoc Anh
Media Library Assistant <= 3.07 - Reflected Cross-Site Scripting
6.1
CVE-2023-34010
Jul 12, 2023
Researcher: Phd
Media Library Assistant <= 2.81 - Authenticated Cross-Site Scripting
6.1
CVE-2020-11731
Dec 15, 2019
Researchers:
Media Library Assistant <= 2.73 - Cross-Site Scripting
6.1
CVE-2018-20982
May 28, 2018
Researchers:
Media Library Assistant <= 3.39 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2026-66601
Aug 19, 2026
Researcher: nh4tvd
Media Library Assistant <= 3.39 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-66591
Aug 18, 2026
Researcher: Abdullah Kareem "cyberkareem"
Media Library Assistant <= 3.34 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-34897
Apr 6, 2026
Researcher: Sajjad Haqi
Media Library Assistant <= 3.28 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2025-59590
Sep 22, 2025
Researcher: Muhammad Yudha - DJ
Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes
6.4
CVE-2025-7035
Jul 15, 2025
Researcher: Muhammad Yudha - DJ
Media Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode
6.4
CVE-2024-2475
Mar 28, 2024
Researcher: stealthcopter
Media Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcode
6.4
CVE-2024-2871
Mar 25, 2024
Researcher: stealthcopter
Title Status CVE ID CVSS Researchers Date
Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification Patched CVE-2026-3072 4.3 Muhammad Sharief March 4, 2026
Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion Patched CVE-2025-8357 4.3 wesley (wcraft) August 18, 2025
Media Library Assistant <= 3.24 - Authenticated (Administrator+) Stored Cross-Site Scripting Patched CVE-2025-31627 4.4 UKO March 31, 2025
Media Library Assistant <= 3.29 - Unauthenticated Limited File Read Patched CVE-2025-11738 5.3 Lucas Montes (NiRoX) October 17, 2025
Media Library Assistant <= 3.29 - Missing Authorization Patched CVE-2025-63065 5.3 Certus Cybersecurity October 9, 2025
Media Library Assistant <= 3.00 - Information Disclosure Patched CVE-2022-41618 5.3 Brandon James Roldan (tomorrowisnew) September 29, 2022
Media Library Assistant <= 3.35 - Reflected Cross-Site Scripting Patched CVE-2026-54198 6.1 Bonds June 15, 2026
Media Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters Patched CVE-2024-11974 6.1 vgo0 January 3, 2025
Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting Patched CVE-2024-5544 6.1 Le Ngoc Anh July 1, 2024
Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang Patched CVE-2024-3519 6.1 Le Ngoc Anh May 21, 2024
Media Library Assistant <= 3.07 - Reflected Cross-Site Scripting Patched CVE-2023-34010 6.1 Phd July 12, 2023
Media Library Assistant <= 2.81 - Authenticated Cross-Site Scripting Patched CVE-2020-11731 6.1 December 15, 2019
Media Library Assistant <= 2.73 - Cross-Site Scripting Patched CVE-2018-20982 6.1 May 28, 2018
Media Library Assistant <= 3.39 - Authenticated (Subscriber+) Stored Cross-Site Scripting Patched CVE-2026-66601 6.4 nh4tvd August 19, 2026
Media Library Assistant <= 3.39 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2026-66591 6.4 Abdullah Kareem "cyberkareem" August 18, 2026
Media Library Assistant <= 3.34 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2026-34897 6.4 Sajjad Haqi April 6, 2026
Media Library Assistant <= 3.28 - Authenticated (Author+) Stored Cross-Site Scripting Patched CVE-2025-59590 6.4 Muhammad Yudha - DJ September 22, 2025
Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes Patched CVE-2025-7035 6.4 Muhammad Yudha - DJ July 15, 2025
Media Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode Patched CVE-2024-2475 6.4 stealthcopter March 28, 2024
Media Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcode Patched CVE-2024-2871 6.4 stealthcopter March 25, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation