CVE-2026-103875

The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search-string' parameter in all versions up to, and including, 3.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-103875 Media Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links

The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search-string' parameter in all versions up to, and including, 3.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-103875

The Media Library Assistant plugin for WordPress (versions up to and including 3.42 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the 'search-string' parameter. An unauthenticated attacker can inject arbitrary we...

EUVD-2026-112683

The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search-string' parameter in all versions up to, and including, 3.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-6641

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlagallery' shortcode in versions up to and including 3.35. This is due to insufficient input sanitization and output escaping on the mlalinkhref parameter when mlaoutput is set to...

CVE-2026-6641

Media Library Assistant is a WordPress plugin vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.35 . The flaw resides in the mla_gallery shortcode: when the mla_output parameter is set to paginate_links, the mla_link_href parameter is processed by _paginate_links()...

EUVD-2026-76007

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlagallery' shortcode in versions up to and including 3.35. This is due to insufficient input sanitization and output escaping on the mlalinkhref parameter when mlaoutput is set to...

CVE-2026-6641: Improper Neutralization of Input During Web Page Generation

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlagallery' shortcode in versions up to and including 3.35. This is due to insufficient input sanitization and output escaping on the mlalinkhref parameter when mlaoutput is set to...

Media Library Assistant < 2.82 - Unauthenticated Limited Local File Inclusion Detection

Media Library Assistant plugin for WordPress before 2.82 contains a local file inclusion caused by unsanitized mlagallery link parameter, letting attackers include arbitrary local files, exploit requires access to the vulnerable link. !/usr/bin/env python3 -- coding: utf-8 -- """Media Library...

CVE-2023-4716: Improper Neutralization of Input During Web Page Generation

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlagallery' shortcode in versions up to, and including, 3.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2020-11928

In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the taxquery, metaquery, or datequery parameter in mlagallery via an admin...

Remote code execution

In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the taxquery, metaquery, or datequery parameter in mlagallery via an admin...

CVE-2020-11732: Undefined Security Weakness

The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mlagallery link=download...

Media Library Assistant < 2.82 - Unauthenticated Limited Local File Inclusion

The Media Library Assistant plugin before 2.82 for WordPress suffers from a Local File Inclusion vulnerability in mlagallery link=download. PoC The LFI is restricted to the "wp-content" directory...