1054 matches found
WordPress Media Library Assistant <= 3.34 - SQL Injection
David Lingren Media Library Assistant = 3.34 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input. id: CVE-2026-34885 info: name: WordPress Media Library Assistant = 3.34 -...
Media Library Assistant < 2.82 - Unauthenticated Limited Local File Inclusion
Media Library Assistant plugin for WordPress before 2.82 contains a local file inclusion caused by unsanitized mlagallery link parameter, letting attackers include arbitrary local files, exploit requires access to the vulnerable link. id: CVE-2020-11732 info: name: Media Library Assistant 2.82 -...
Media Library Assistant < 3.09 - Remote Code Execution/Local File Inclusion
A vulnerability in the Wordpress Media-Library-Assistant plugins in version 3.09 is vulnerable to a local file inclusion which leading to RCE on default Imagegick installation/configuration. id: CVE-2023-4634 info: name: Media Library Assistant 3.09 - Remote Code Execution/Local File Inclusion...
CVE-2026-15384
The CVE-2026-15384 entry covers the WordPress plugin Manual Image Crop (<= v1.15). The authenticated AJAX action used to crop attachment images has no capability check or nonce verification, so any logged-in user can supply an arbitrary attachment ID to overwrite generated intermediate images ...
EUVD-2026-59910
The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment images; its only guard passes for any logged-in user. A subscriber-level user can therefore supply an arbitrary attachment ID and...
CVE-2026-61963
Unauthenticated Cross Site Scripting XSS in Media LIbrary Assistant = 3.38 versions...
EUVD-2026-53958
Unauthenticated Cross Site Scripting XSS in Media LIbrary Assistant = 3.38 versions...
CVE-2026-61963
Unauthenticated Cross Site Scripting XSS in Media LIbrary Assistant = 3.38 versions...
CVE-2026-61963
WordPress Media Library Assistant plugin ≤ 3.38 has an unauthenticated XSS vulnerability. The CVE and connected records describe unauthenticated cross-site scripting in versions up to 3.38. No root-cause, exploit details, or remediation are provided in the documents; further specifics on impact a...
CVE-2026-61963 WordPress Media LIbrary Assistant plugin <= 3.38 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Media LIbrary Assistant = 3.38 versions...
WordPress Media LIbrary Assistant plugin <= 3.38 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Media LIbrary Assistant versions = 3.38...
UBUNTU-CVE-2026-64131
In the Linux kernel, the following vulnerability has been resolved: mm/memory: fix spurious warning when unmapping device-private/exclusive pages Device private and exclusive entries are only supported for anonymous folios. This condition is tested in migratedevicepages and makedeviceexclusive...
CVE-2026-12684
The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files bounded to an image a...
CVE-2026-12684
The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files bounded to an image a...
CVE-2026-12684
CVE-2026-12684 affects the Customer Reviews for WooCommerce WordPress plugin prior to version 5.113.0. The issue is an unauthenticated media upload via a media upload AJAX action when the review media attachment feature is enabled. The vulnerability arises from missing authentication, capability,...
EUVD-2026-44877
The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files bounded to an image a...
CVE-2026-11579
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload...
CVE-2026-11579
CVE-2026-11579 affects the Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin up to version 2.4.17. The issue arises because the plugin does not verify that a file upload is tied to an existing form with a file-upload field, allowing unauthenticated users to upload files to the Wo...
CVE-2026-11579
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload...
EUVD-2026-44592
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload...