WordPress Media Library Assistant <= 3.34 - SQL Injection

David Lingren Media Library Assistant = 3.34 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input. id: CVE-2026-34885 info: name: WordPress Media Library Assistant = 3.34 -...

Media Library Assistant < 2.82 - Unauthenticated Limited Local File Inclusion

Media Library Assistant plugin for WordPress before 2.82 contains a local file inclusion caused by unsanitized mlagallery link parameter, letting attackers include arbitrary local files, exploit requires access to the vulnerable link. id: CVE-2020-11732 info: name: Media Library Assistant 2.82 -...

CVE-2023-4634-PoC

CVE-2023-4634 - WordPress 플러그인 Media Library Assistant의 RCE 취약점 1. 환경 구축 및 실행 root@kitploit: cd Stand docker-compose up --build -d 2. 서비스 시작 대기 60초 root@kitploit: sleep 60 curl -I http://localhost:8080 3. 취약점 스캔 실행 root@kitploit: cd ../PoC/src python3 scanner.py http://localhost:8080 4. 수동 RCE...

CVE-2023-4634

CVE-2023-4634 WordPressプラグインMedia-Library Plugin 3.10 のRCEエクスプロイト CVE-2023-4634 Info Patrowlは、Media-Librairy-Assistant WordPressプラグインのバージョン3.10未満において、認証を必要としないRCE脆弱性を発見しました。 このエクスプロイトは簡単ではなく、以下に説明する少しの設定が必要です。 エクスプロイトの発見と悪用の詳細はブログでご覧いただけます:...

CVE-2026-6642

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. This is due to insufficient output escaping on preset field values when they are rendered in HTML attribute contexts...

CVE-2026-6641

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlagallery' shortcode in versions up to and including 3.35. This is due to insufficient input sanitization and output escaping on the mlalinkhref parameter when mlaoutput is set to...

CVE-2026-6640

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlalinkattributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-6640 Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlalinkattributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-6642

The Media Library Assistant WordPress plugin (versions up to and including 3.35 ) is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism. The root cause is insufficient output escaping in the mla_generate_bulk_edit_form_fieldsets() function and the mla-bulk-...

EUVD-2026-76009

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlalinkattributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-6640

The Media Library Assistant WordPress plugin is vulnerable to Stored Cross-Site Scripting via the mla_link_attributes parameter in all versions up to and including 3.35 , caused by insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher...

CVE-2026-6642 Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. This is due to insufficient output escaping on preset field values when they are rendered in HTML attribute contexts...

EUVD-2026-76008

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. This is due to insufficient output escaping on preset field values when they are rendered in HTML attribute contexts...

CVE-2026-6641

Media Library Assistant is a WordPress plugin vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.35 . The flaw resides in the mla_gallery shortcode: when the mla_output parameter is set to paginate_links, the mla_link_href parameter is processed by _paginate_links()...

CVE-2026-6641 Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlagallery' shortcode in versions up to and including 3.35. This is due to insufficient input sanitization and output escaping on the mlalinkhref parameter when mlaoutput is set to...

EUVD-2026-76007

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlagallery' shortcode in versions up to and including 3.35. This is due to insufficient input sanitization and output escaping on the mlalinkhref parameter when mlaoutput is set to...

WordPress Media LIbrary Assistant plugin <= 3.35 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by TruongLV1 From FPT Night Wolf - FPT Night Wolf in WordPress Plugin Media LIbrary Assistant versions = 3.35...

WordPress Media Library Assistant plugin <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by gidget smith in WordPress Plugin Media LIbrary Assistant versions = 3.35...

WordPress Media Library Assistant plugin <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by normaandersonfrank in WordPress Plugin Media LIbrary Assistant versions = 3.35...

Media Library Assistant < 3.09 - Remote Code Execution/Local File Inclusion

A vulnerability in the Wordpress Media-Library-Assistant plugins in version 3.09 is vulnerable to a local file inclusion which leading to RCE on default Imagegick installation/configuration. id: CVE-2023-4634 info: name: Media Library Assistant 3.09 - Remote Code Execution/Local File Inclusion...