PT-2026-79304

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection...

CVE-2026-16959: Improper Neutralization of Special Elements used in an SQL Command

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection...

CVE-2026-66600

Author Arbitrary File Upload in Media LIbrary Assistant = 3.39 versions...

CVE-2026-66601

Subscriber Cross Site Scripting XSS in Media LIbrary Assistant = 3.39 versions...

CVE-2026-66600 WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerability

Author Arbitrary File Upload in Media LIbrary Assistant = 3.39 versions...

EUVD-2026-63342

Subscriber Cross Site Scripting XSS in Media LIbrary Assistant = 3.39 versions...

CVE-2026-66600 WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerability

Author Arbitrary File Upload in Media LIbrary Assistant = 3.39 versions...

EUVD-2026-63341

Author Arbitrary File Upload in Media LIbrary Assistant = 3.39 versions...

CVE-2026-66600

Media Library Assistant WordPress plugin (versions ≤ 3.39) allows users with the Author role to upload arbitrary files, potentially enabling remote code execution. CVSS 9.1 (Critical) reflects network-exploitable, low-complexity attack with full confidentiality, integrity, and availability impact...

CVE-2026-66601 WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Media LIbrary Assistant = 3.39 versions...

CVE-2026-66601

Subscriber-level authenticated users can inject arbitrary JavaScript into the Media Library Assistant plugin (≤3.39) admin interface, enabling session hijacking or data theft. CVSS 6.5 (MEDIUM). Update to version 3.40 or later; no in-the-wild exploitation reported. See: https://patchstack.com/dat...

PT-2026-78963

Subscriber Cross Site Scripting XSS in Media LIbrary Assistant = 3.39 versions...

PT-2026-78962

Author Arbitrary File Upload in Media LIbrary Assistant = 3.39 versions...

CVE-2026-66601: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in Media LIbrary Assistant = 3.39 versions...

CVE-2026-66600: Unrestricted Upload of File with Dangerous Type

Author Arbitrary File Upload in Media LIbrary Assistant = 3.39 versions...

WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Media LIbrary Assistant versions = 3.39...

WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by nh4tvd in WordPress Plugin Media LIbrary Assistant versions = 3.39...

EUVD-2026-62210

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39...

CVE-2026-66591

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39...

CVE-2026-66591 WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39...