Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
Media Library Assistant - Cross-Site Scripting (XSS) (CVE-2023-24385)
Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in David Lingren Media Library Assistant plugin
PLUGIN
Media Library Assistant
CVE-2023-24385
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - Cross-Site Scripting (XSS) (CVE-2023-4716)
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up to, and including, 3.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Media Library Assistant
CVE-2023-4716
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - Remote Code Execution (CVE-2023-4634)
The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from the ~/includes/mla-stream-image.php file, where images are processed via Imagick(). This makes it possible for unauthenticated attackers to supply files via FTP that will make directory lists, local file inclusion, and remote code execution possible.
PLUGIN
Media Library Assistant
CVE-2023-4634
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - Cross-Site Scripting (XSS) (CVE-2023-34010)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in submodule of David Lingren Media Library Assistant plugin
PLUGIN
Media Library Assistant
CVE-2023-34010
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - SQL Injection (CVE-2023-0279)
The Media Library Assistant WordPress plugin before 3.06 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
PLUGIN
Media Library Assistant
CVE-2023-0279
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - Security Vulnerability (CVE-2022-41618)
Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin
PLUGIN
Media Library Assistant
CVE-2022-41618
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - Remote Code Execution (CVE-2020-11928)
In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_query parameter in mla_gallery via an admin.
PLUGIN
Media Library Assistant
CVE-2020-11928
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - Path Traversal (CVE-2020-11732)
The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_gallery link=download.
PLUGIN
Media Library Assistant
CVE-2020-11732
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - Cross-Site Scripting (XSS) (CVE-2020-11731)
The Media Library Assistant plugin before 2.82 for Wordpress suffers from multiple XSS vulnerabilities in all Settings/Media Library Assistant tabs, which allow remote authenticated users to execute arbitrary JavaScript.
PLUGIN
Media Library Assistant
CVE-2020-11731
Risk Score
Threat Entry
Updated 2026-06-17
Media Library Assistant - Cross-Site Scripting (XSS) (CVE-2018-20982)
The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens.
PLUGIN
Media Library Assistant
CVE-2018-20982
Risk Score