CVE-2026-113481 Media Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fields

The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and pos...

CVE-2026-113481 Media Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fields

The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and pos...

CVE-2026-113481

The Media Library Assistant WordPress plugin versions before 3.44 is vulnerable to a Missing Authorization (CWE-862) flaw. The plugin fails to verify if a requesting user has permission to view a post before disclosing the taxonomy terms assigned to it. This allows any authenticated user , such a...

PT-2026-89794

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla gallery' shortcode in versions up to and including 3.35. This is due to insufficient input sanitization and output escaping on the mla link href parameter when mla output is set to 'paginate...

EUVD-2025-144316

Malicious code in namei-mla-anubuiau npm...

EUVD-2025-144319

Malicious code in namei-mla-aninu npm...

EUVD-2025-144322

Malicious code in namei-mla-abnubuiau npm...

EUVD-2025-144314

Malicious code in namei-mla-anuu npm...

EUVD-2025-144321

Malicious code in namei-mla-abunubuiau npm...

EUVD-2025-144318

Malicious code in namei-mla-anu npm...

Malicious code in namei-mla-anuiau (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a859d09c9b914137d09e3fb42407d39f7ccad5ccd103c092648ada0706971b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-144315

Malicious code in namei-mla-anuiau npm...

EUVD-2025-144320

Malicious code in namei-mla-ainianu npm...

EUVD-2025-144317

Malicious code in namei-mla-anubiau npm...

CVE-2025-11738

The Media Library Assistant plugin for WordPress is vulnerable to limited file reading in all versions up to, and including, 3.29 via the mla-stream-image.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary ai/eps/pdf/ps files on the server, which can...

CVE-2025-11738 Media Library Assistant <= 3.29 - Unauthenticated Limited File Read

The Media Library Assistant plugin for WordPress is vulnerable to limited file reading in all versions up to, and including, 3.29 via the mla-stream-image.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary ai/eps/pdf/ps files on the server, which can...

CVE-2025-11738 Media Library Assistant <= 3.29 - Unauthenticated Limited File Read

The Media Library Assistant plugin for WordPress is vulnerable to limited file reading in all versions up to, and including, 3.29 via the mla-stream-image.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary ai/eps/pdf/ps files on the server, which can...

PT-2025-42689

Name of the Vulnerable Software and Affected Versions Media Library Assistant plugin for WordPress versions prior to 3.30 Description The Media Library Assistant plugin for WordPress is susceptible to limited file reading through the mla-stream-image.php file. This allows unauthenticated attacker...

CVE-2025-11738: External Control of File Name or Path

The Media Library Assistant plugin for WordPress is vulnerable to limited file reading in all versions up to, and including, 3.29 via the mla-stream-image.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary ai/eps/pdf/ps files on the server, which can...

WordPress Media Library Assistant plugin <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action vulnerability

Authenticated Author+ Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action vulnerability discovered by wesley wcraft in WordPress Plugin Media LIbrary Assistant versions = 3.18...