WordPress Media Library Assistant < 3.40 - SQL Injection

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role and above to perform SQL injection. id: CVE-2026-16959 info: name: WordPress Media...

WordPress Media Library Assistant <= 3.34 - SQL Injection

David Lingren Media Library Assistant = 3.34 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input. id: CVE-2026-34885 info: name: WordPress Media Library Assistant = 3.34 -...

CVE-2026-113481

The Media Library Assistant WordPress plugin versions before 3.44 is vulnerable to a Missing Authorization (CWE-862) flaw. The plugin fails to verify if a requesting user has permission to view a post before disclosing the taxonomy terms assigned to it. This allows any authenticated user , such a...

CVE-2026-113482

The Media Library Assistant WordPress plugin (versions before 3.44 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The issue occurs because the plugin fails to escape one of its shortcode attributes, specifically the mla_item_parameter attribute, before outputting it into the attributes of...

EUVD-2026-114778

The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-113482 Media Library Assistant < 3.44 - Contributor+ Stored XSS via mla_item_parameter Shortcode Attribute

The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

EUVD-2026-114777

The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and pos...

WordPress Media Library Assistant plugin < 3.44 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Media LIbrary Assistant versions 3.44...

WordPress Media Library Assistant plugin < 3.44 - Subscriber+ Missing Authorization vulnerability

Subscriber+ Missing Authorization vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Media LIbrary Assistant versions 3.44...

CVE-2026-113481 Media Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fields

The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and pos...

CVE-2026-113482

The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-113481

The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and pos...

Media Library Assistant < 2.82 - Unauthenticated Limited Local File Inclusion

Media Library Assistant plugin for WordPress before 2.82 contains a local file inclusion caused by unsanitized mlagallery link parameter, letting attackers include arbitrary local files, exploit requires access to the vulnerable link. id: CVE-2020-11732 info: name: Media Library Assistant 2.82 -...

CVE-2026-113482: Unknown Media Library Assistant: The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before…

The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-113481: Unknown Media Library Assistant: The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a…

The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and pos...

CVE-2023-4634-PoC

CVE-2023-4634 - RCE Vulnerability in WordPress Plugin Media Library Assistant 1. Build and launch environment cd Stand docker-compose up --build -d 2. Wait for services to start 60 seconds sleep 60 curl -I http://localhost:8080 3. Run vulnerability scan cd ../PoC/src python3 scanner.py...

CVE-2023-4634

CVE-2023-4634 RCE Exploit for Wordpress Plugin Media-Library Plugin 3.10 CVE-2023-4634 Info Patrowl discovered An unauthenticated RCE Vulnerability on Media-Librairy-Assistant Wordpress Plugin in version 3.10. The exploit is not trivial and requires just a little setup explained bellow. Global...

Media Library Assistant < 3.09 - Remote Code Execution/Local File Inclusion

A vulnerability in the Wordpress Media-Library-Assistant plugins in version 3.09 is vulnerable to a local file inclusion which leading to RCE on default Imagegick installation/configuration. id: CVE-2023-4634 info: name: Media Library Assistant 3.09 - Remote Code Execution/Local File Inclusion...

CVE-2026-118095

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows DOM-Based XSS.This issue affects Media LIbrary Assistant: from n/a through 3.42...

CVE-2026-118095 WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows DOM-Based XSS.This issue affects Media LIbrary Assistant: from n/a through 3.42...