WordSec
WordSec

Media Library Assistant

Explore Media Library Assistant vulnerabilities across all versions. Currently tracking 32 known vulnerabilities, including severity, impact, and patch status.

01234567891028.05.2018Today28.05.20186.1Media Library Assistant <= 2.73 - Cross-Site Scripting CVSS 6.1 · 28.05.201815.12.20199.8Media Library Assistant <= 2.81 - Remote Code Execution via tax_query, meta_query, date_query Parameters CVSS 9.8 · 15.12.20196.1Media Library Assistant <= 2.81 - Authenticated Cross-Site Scripting CVSS 6.1 · 15.12.20197.5Media Library Assistant <= 2.81 - Local File Inclusion CVSS 7.5 · 15.12.201929.09.20225.3Media Library Assistant <= 3.00 - Information Disclosure CVSS 5.3 · 29.09.202216.02.20237.2Media Library Assistant <= 3.05 - Authenticated (Administrator+) SQL Injection CVSS 7.2 · 16.02.202312.07.20236.1Media Library Assistant <= 3.07 - Reflected Cross-Site Scripting CVSS 6.1 · 12.07.202305.09.20239.8Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution CVSS 9.8 · 05.09.202321.09.20236.4Media Library Assistant <= 3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 6.4 · 21.09.202302.10.20236.4Media Library Assistant <= 3.11 - Authenticated (Author+) Stored Cross-Site Scripting CVSS 6.4 · 02.10.202325.03.20246.4Media Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcode CVSS 6.4 · 25.03.202428.03.20246.4Media Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode CVSS 6.4 · 28.03.202421.05.20248.8Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode CVSS 8.8 · 21.05.20246.1Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang CVSS 6.1 · 21.05.202419.06.20248.8Media Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameter CVSS 8.8 · 19.06.202401.07.20246.1Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting CVSS 6.1 · 01.07.202412.08.20248.8Media Library Assistant <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action CVSS 8.8 · 12.08.202401.11.20247.2Media Library Assistant <= 3.19 - Authenticated (Administrator+) Remote Code Execution CVSS 7.2 · 01.11.202403.01.20256.1Media Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters CVSS 6.1 · 03.01.202531.03.20254.4Media Library Assistant <= 3.24 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 31.03.202515.07.20256.4Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes CVSS 6.4 · 15.07.202518.08.20254.3Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion CVSS 4.3 · 18.08.202522.09.20256.4Media Library Assistant <= 3.28 - Authenticated (Author+) Stored Cross-Site Scripting CVSS 6.4 · 22.09.202509.10.20255.3Media Library Assistant <= 3.29 - Missing Authorization CVSS 5.3 · 09.10.202517.10.20255.3Media Library Assistant <= 3.29 - Unauthenticated Limited File Read CVSS 5.3 · 17.10.202520.02.20266.5Media LIbrary Assistant <= 3.32 - Authenticated (Contributor+) SQL Injection CVSS 6.5 · 20.02.202604.03.20264.3Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification CVSS 4.3 · 04.03.202606.04.20266.5Media Library Assistant <= 3.34 - Authenticated (Contributor+) SQL Injection CVSS 6.5 · 06.04.20266.4Media Library Assistant <= 3.34 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 06.04.202628.05.20268.1Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form CVSS 8.1 · 28.05.202615.06.20266.1Media Library Assistant <= 3.35 - Reflected Cross-Site Scripting CVSS 6.1 · 15.06.202618.06.20266.5Media Library Assistant <= 3.35 - Authenticated (Contributor+) SQL Injection CVSS 6.5 · 18.06.2026

Strategic Overview

Avg CVSSMedium
6.6/ 10
Patch Coverage100%
Open

0

Fixed

32

Get automatic notifications for all Media Library Assistant vulnerabilities before they are exploited.

Vulnerability Records

32 records
2026-06-18 00:00
Media Library Assistant <= 3.35 - Authenticated (Contributor+) SQL Injection
Media Library Assistant
<= 3.35
CVE-2026-56012
6.5
Medium
darooYes
2026-06-15 00:00
Media Library Assistant <= 3.35 - Reflected Cross-Site Scripting
Media Library Assistant
<= 3.35
CVE-2026-54198
6.1
Medium
BondsYes
2026-05-28 18:57
Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form
Media Library Assistant
<= 3.35
CVE-2026-6075
8.1
High
Jack Pas (Dark.)Yes
2026-04-06 00:00
Media Library Assistant <= 3.34 - Authenticated (Contributor+) SQL Injection
Media Library Assistant
<= 3.34
CVE-2026-34885
6.5
Medium
Sajjad HaqiYes
2026-04-06 00:00
Media Library Assistant <= 3.34 - Authenticated (Contributor+) Stored Cross-Site Scripting
Media Library Assistant
<= 3.34
CVE-2026-34897
6.4
Medium
Sajjad HaqiYes
2026-03-04 16:31
Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification
Media Library Assistant
<= 3.33
CVE-2026-3072
4.3
Medium
Muhammad ShariefYes
2026-02-20 00:00
Media LIbrary Assistant <= 3.32 - Authenticated (Contributor+) SQL Injection
Media Library Assistant
<= 3.32
CVE-2026-32399
6.5
Medium
Doan Dinh Van (d52v)Yes
2025-10-17 17:26
Media Library Assistant <= 3.29 - Unauthenticated Limited File Read
Media Library Assistant
<= 3.29
CVE-2025-11738
5.3
Medium
Lucas Montes (NiRoX)Yes
2025-10-09 00:00
Media Library Assistant <= 3.29 - Missing Authorization
Media Library Assistant
<= 3.29
CVE-2025-63065
5.3
Medium
Certus CybersecurityYes
2025-09-22 00:00
Media Library Assistant <= 3.28 - Authenticated (Author+) Stored Cross-Site Scripting
Media Library Assistant
<= 3.28
CVE-2025-59590
6.4
Medium
Muhammad Yudha - DJYes
Showing 1–10 of 32 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C