WordPress Media Library Assistant <= 3.34 - SQL Injection

David Lingren Media Library Assistant = 3.34 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input. id: CVE-2026-34885 info: name: WordPress Media Library Assistant = 3.34 -...

WordPress Media Library Assistant < 3.40 - SQL Injection

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role and above to perform SQL injection. id: CVE-2026-16959 info: name: WordPress Media...

Media Library Assistant < 2.82 - Unauthenticated Limited Local File Inclusion

Media Library Assistant plugin for WordPress before 2.82 contains a local file inclusion caused by unsanitized mlagallery link parameter, letting attackers include arbitrary local files, exploit requires access to the vulnerable link. id: CVE-2020-11732 info: name: Media Library Assistant 2.82 -...

CVE-2023-4634

CVE-2023-4634 RCE Exploit for Wordpress Plugin Media-Library Plugin 3.10 CVE-2023-4634 Info Patrowl discovered An unauthenticated RCE Vulnerability on Media-Librairy-Assistant Wordpress Plugin in version 3.10. The exploit is not trivial and requires just a little setup explained bellow. Global...

CVE-2023-4634-PoC

CVE-2023-4634 - RCE Vulnerability in WordPress Plugin Media Library Assistant 1. Build and launch environment cd Stand docker-compose up --build -d 2. Wait for services to start 60 seconds sleep 60 curl -I http://localhost:8080 3. Run vulnerability scan cd ../PoC/src python3 scanner.py...

Media Library Assistant < 3.09 - Remote Code Execution/Local File Inclusion

A vulnerability in the Wordpress Media-Library-Assistant plugins in version 3.09 is vulnerable to a local file inclusion which leading to RCE on default Imagegick installation/configuration. id: CVE-2023-4634 info: name: Media Library Assistant 3.09 - Remote Code Execution/Local File Inclusion...

CVE-2026-119496

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Code Injection.This issue affects Media LIbrary Assistant: from n/a through 3.43...

EUVD-2026-119132

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Code Injection.This issue affects Media LIbrary Assistant: from n/a through 3.43...

CVE-2026-119496 WordPress Media LIbrary Assistant plugin <= 3.43 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Code Injection.This issue affects Media LIbrary Assistant: from n/a through 3.43...

CVE-2026-119496

The David Lingren Media LIbrary Assistant WordPress plugin (versions

CVE-2026-119496 WordPress Media LIbrary Assistant plugin <= 3.43 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Code Injection.This issue affects Media LIbrary Assistant: from n/a through 3.43...

WordPress Media LIbrary Assistant plugin <= 3.43 - Content Injection vulnerability

Content Injection vulnerability discovered by dzaku in WordPress Plugin Media LIbrary Assistant versions = 3.43...

CVE-2026-119491

Missing Authorization vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media LIbrary Assistant: from n/a through 3.43...

EUVD-2026-119023

Missing Authorization vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media LIbrary Assistant: from n/a through 3.43...

CVE-2026-119491

The Media Library Assistant WordPress plugin (versions through 3.43 ) is vulnerable to a Broken Access Control vulnerability (CWE-862). The flaw stems from Missing Authorization , specifically allowing for the exploitation of incorrectly configured access control security levels. While the vulner...

CVE-2026-119491 WordPress Media LIbrary Assistant plugin <= 3.43 - Broken Access Control vulnerability

Missing Authorization vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media LIbrary Assistant: from n/a through 3.43...

WordPress Media LIbrary Assistant plugin <= 3.43 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by yzx001 in WordPress Plugin Media LIbrary Assistant versions = 3.43...

CVE-2026-113481 Media Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fields

The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and pos...

WordPress Media Library Assistant plugin < 3.44 - Subscriber+ Missing Authorization vulnerability

Subscriber+ Missing Authorization vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Media LIbrary Assistant versions 3.44...

CVE-2026-113482

The Media Library Assistant WordPress plugin (versions before 3.44 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The issue occurs because the plugin fails to escape one of its shortcode attributes, specifically the mla_item_parameter attribute, before outputting it into the attributes of...