Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-07-21
Media Library Assistant - Cross-Site Request Forgery (CSRF) (CVE-2026-6075)
The Media Library Assistant plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.35 This is due to missing nonce verification on the bulk action handlers in the settings tab handlers. This makes it possible for unauthenticated attackers to trick an administrator into performing bulk delete, edit, or purge operations on plugin settings and attachment metadata via a forged request.
PLUGIN
Media Library Assistant
CVE-2026-6075
Risk Score
Threat Entry
Updated 2026-10-26
Media Library Assistant - SQL Injection (CVE-2026-34885)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant allows SQL Injection.This issue affects Media LIbrary Assistant: from n/a through 3.34.
PLUGIN
Media Library Assistant
CVE-2026-34885
Risk Score
Threat Entry
Updated 2026-10-26
Media Library Assistant - Cross-Site Scripting (XSS) (CVE-2026-34897)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through 3.34.
PLUGIN
Media Library Assistant
CVE-2026-34897
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - SQL Injection (CVE-2026-32399)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind SQL Injection.This issue affects Media LIbrary Assistant: from n/a through
PLUGIN
Media Library Assistant
CVE-2026-32399
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - Broken Access Control (CVE-2026-3072)
The Media Library Assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mla_update_compat_fields_action() function in all versions up to, and including, 3.33. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify taxonomy terms on arbitrary attachments.
PLUGIN
Media Library Assistant
CVE-2026-3072
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - Broken Access Control (CVE-2025-63065)
Authorization Bypass Through User-Controlled Key vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media LIbrary Assistant: from n/a through
PLUGIN
Media Library Assistant
CVE-2025-63065
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - Information Disclosure (CVE-2025-11738)
The Media Library Assistant plugin for WordPress is vulnerable to limited file reading in all versions up to, and including, 3.29 via the mla-stream-image.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary ai/eps/pdf/ps files on the server, which can contain sensitive information.
PLUGIN
Media Library Assistant
CVE-2025-11738
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - Cross-Site Scripting (XSS) (CVE-2025-59590)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through
PLUGIN
Media Library Assistant
CVE-2025-59590
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - Security Vulnerability (CVE-2025-8357)
The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file deletion in the /wp-content/uploads directory due to insufficient file path validation and user capability checking in the _process_mla_download_file function in all versions up to, and including, 3.27. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server from the /wp-content/uploads/ directory.
PLUGIN
Media Library Assistant
CVE-2025-8357
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - Cross-Site Scripting (XSS) (CVE-2025-7035)
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mla_tag_cloud and mla_term_list shortcodes in all versions up to, and including, 3.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Media Library Assistant
CVE-2025-7035
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - Cross-Site Scripting (XSS) (CVE-2025-31627)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through
PLUGIN
Media Library Assistant
CVE-2025-31627
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - Cross-Site Scripting (XSS) (CVE-2024-11974)
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘smc_settings_tab', 'unattachfixit-action', and 'woofixit-action’ parameters in all versions up to, and including, 3.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Media Library Assistant
CVE-2024-11974
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - Security Vulnerability (CVE-2024-51661)
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Command Injection.This issue affects Media LIbrary Assistant: from n/a through
PLUGIN
Media Library Assistant
CVE-2024-51661
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - Remote Code Execution (CVE-2024-6823)
The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation involving the mla-inline-edit-upload-scripts AJAX action in all versions up to, and including, 3.18. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Media Library Assistant
CVE-2024-6823
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - Cross-Site Scripting (XSS) (CVE-2024-5544)
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order parameter in all versions up to, and including, 3.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Media Library Assistant
CVE-2024-5544
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - SQL Injection (CVE-2024-5605)
The Media Library Assistant plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter within the mla_tag_cloud Shortcode in all versions up to, and including, 3.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Media Library Assistant
CVE-2024-5605
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - SQL Injection (CVE-2024-3518)
The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and including, 3.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Media Library Assistant
CVE-2024-3518
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - Cross-Site Scripting (XSS) (CVE-2024-3519)
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the lang parameter in all versions up to, and including, 3.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Media Library Assistant
CVE-2024-3519
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - SQL Injection (CVE-2024-2871)
The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and including, 3.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Media Library Assistant
CVE-2024-2871
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - Cross-Site Scripting (XSS) (CVE-2024-2475)
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Media Library Assistant
CVE-2024-2475
Risk Score