Plugin icon

Media Library Assistant

media-library-assistant

Vulnerabilities:

27

Last Updated:

March 30, 2026

Active Installs:

70000

Published
Title
Fixed in
CVSS
Published
2026-03-04
Title
Media Library Assistant < 3.34 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification
Fixed in
Fixed in 3.34
CVSS
4.3 (medium)
Published
2025-10-17
Title
Media Library Assistant < 3.30 - Unauthenticated Limited File Read
Fixed in
Fixed in 3.30
CVSS
5.3 (medium)
Published
2025-10-09
Title
Media Library Assistant < 3.30 - Missing Authorization
Fixed in
Fixed in 3.30
CVSS
5.3 (medium)
Published
2025-09-22
Title
Media Library Assistant < 3.29 - Authenticated (Author+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.29
CVSS
6.4 (medium)
Published
2025-08-18
Title
Media Library Assistant < 3.28 - Authenticated (Author+) Limited File Deletion
Fixed in
Fixed in 3.28
CVSS
4.3 (medium)
Published
2025-07-15
Title
Media Library Assistant < 3.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes
Fixed in
Fixed in 3.27
CVSS
6.4 (medium)
Published
2025-03-31
Title
Media Library Assistant < 3.25 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.25
CVSS
4.4 (medium)
Published
2025-01-03
Title
Media Library Assistant < 3.24 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters
Fixed in
Fixed in 3.24
CVSS
6.1 (medium)
Published
2024-11-01
Title
Media Library Assistant < 3.20 - Authenticated (Administrator+) Remote Code Execution
Fixed in
Fixed in 3.20
CVSS
7.2 (high)
Published
2024-08-12
Title
Media Library Assistant < 3.19 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action
Fixed in
Fixed in 3.19
CVSS
8.8 (high)
Published
2024-07-01
Title
Media Library Assistant < 3.18 - Reflected Cross-Site Scripting
Fixed in
Fixed in 3.18
CVSS
6.1 (medium)
Published
2024-06-19
Title
Media Library Assistant < 3.17 - Authenticated (Contributor+) SQL Injection via order Parameter
Fixed in
Fixed in 3.17
CVSS
8.8 (high)
Published
2024-05-21
Title
Media Library Assistant < 3.16 - Authenticated (Contributor+) SQL Injection via Shortcode
Fixed in
Fixed in 3.16
CVSS
8.8 (high)
Published
2024-05-21
Title
Media Library Assistant < 3.16 - Reflected Cross-Site Scripting
Fixed in
Fixed in 3.16
CVSS
7.1 (high)
Published
2024-03-28
Title
Media Library Assistant < 3.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode
Fixed in
Fixed in 3.14
CVSS
6.4 (medium)
Published
2024-03-25
Title
Media Library Assistant < 3.14 - Authenticated (Contributor+) SQL Injection via Shortcode
Fixed in
Fixed in 3.14
CVSS
6.4 (medium)
Published
2023-10-17
Title
Media Library Assistant < 3.12 - Author+ Stored XSS
Fixed in
Fixed in 3.12
CVSS
5.9 (medium)
Published
2023-09-21
Title
Media Library Assistant < 3.11 - Contributor+ Stored XSS
Fixed in
Fixed in 3.11
CVSS
6.4 (medium)
Published
2023-09-05
Title
Media Library Assistant < 3.10 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution
Fixed in
Fixed in 3.10
CVSS
8.1 (high)
Published
2023-07-12
Title
Media Library Assistant < 3.08 - Reflected Cross-Site Scripting
Fixed in
Fixed in 3.08
CVSS
5.8 (medium)
Published
2023-02-16
Title
Media Library Assistant < 3.06 - Admin+ SQLi
Fixed in
Fixed in 3.06
CVSS
6.8 (medium)
Published
2022-09-29
Title
Media Library Assistant < 3.01 - Unauthenticated Error Log Access
Fixed in
Fixed in 3.01
CVSS
3.7 (low)
Published
2020-11-24
Title
Media Library Assistant < 2.90 - Authenticated Blind SQL Injection
Fixed in
Fixed in 2.90
CVSS
6.6 (medium)
Published
2020-04-19
Title
Media Library Assistant < 2.82 - Authenticated RCE
Fixed in
Fixed in 2.82
CVSS
9.1 (critical)
Published
2020-04-13
Title
Media Library Assistant < 2.82 - Unauthenticated Limited Local File Inclusion
Fixed in
Fixed in 2.82
CVSS
7.5 (high)
Published
2020-04-13
Title
Media Library Assistant < 2.82 - Authenticated Stored Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.82
CVSS
6.1 (medium)
Published
2018-06-18
Title
Media Library Assistant < 2.7.4 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.7.4
CVSS
6.1 (medium)