CVE-2020-11928

The CVE-2020-11928 entry concerns the WordPress plugin Media Library Assistant (versions before 2.82). The vulnerability allows Remote Code Execution via the mla_gallery component’s tax_query, meta_query, or date_query parameters when accessed through an admin interface. The issue is described ac...

CVE-2023-4634

Summary of CVE-2023-4634 : The WordPress plugin Media Library Assistant (versions up to 3.09, fixed in 3.10) is vulnerable to Local File Inclusion and Remote Code Execution due to insufficient validation of file paths passed to the mla_stream_file parameter in includes/mla-stream-image.php, where...

CVE-2020-11732

Concretely affected: WordPress Media Library Assistant plugin prior to 2.82. Root cause: local file inclusion via unsanitized mla_gallery link parameter (mla_gallery link=download), allowing unauthenticated access to include arbitrary local files. Impact: information disclosure; CVSSv3.1 base sco...

CVE-2020-11731

CVE-2020-11731 affects the WordPress Media Library Assistant plugin prior to 2.82. Multiple XSS vulnerabilities exist in all Settings/Media Library Assistant tabs, enabling remote authenticated users to execute arbitrary JavaScript. Affected version range is WordPress Media Library Assistant plug...

CVE-2024-3519

Summary of CVE-2024-3519 (Media Library Assistant, WordPress): The WordPress plugin Media Library Assistant is vulnerable to a Reflected Cross-Site Scripting (XSS) via the lang parameter in versions up to 3.15. The issue arises from insufficient input sanitization and output escaping, enabling un...

CVE-2022-41618

The CVE-2022-41618 entry describes an Unauthenticated Error Log Disclosure in the WordPress Media Library Assistant plugin before or up to version 3.00. The issue arises from inadequate access controls, allowing unauthenticated users to access the plugin’s error log contents. Affected product: Wo...

CVE-2024-2871

CVE-2024-2871 affects the Media Library Assistant plugin for WordPress. It enables SQL Injection via shortcode parameters in all versions up to 3.13 due to insufficient escaping and lack of proper query preparation, allowing authenticated attackers with contributor access or higher to append addi...

CVE-2024-3518

CVE-2024-3518 : Media Library Assistant for WordPress is vulnerable to SQL Injection via shortcode parameters in all versions up to 3.15, due to insufficient escaping and incomplete query preparation. The issue allows authenticated attackers with contributor access or higher to append additional ...

CVE-2024-5605

CVE-2024-5605 affects the WordPress plugin Media Library Assistant. The vulnerability is a time-based SQL Injection in the mla_tag_cloud shortcode (order parameter) present in all versions up to 3.16. It arises from insufficient escaping and lack of proper SQL preparation, enabling authenticated ...

CVE-2024-2475

CVE-2024-2475 refers to a Stored Cross-Site Scripting vulnerability in the WordPress plugin Media Library Assistant. The issue stems from insufficient input sanitization and output escaping on user-supplied shortcode attributes, allowing an attacker with contributor-level access or higher to inje...

CVE-2024-11974

The CVE-2024-11974 vulnerability affects the Media Library Assistant WordPress plugin. It enables Reflected Cross-Site Scripting via the smc_settings_tab, unattachfixit-action, and woofixit-action parameters in all versions up to and including 3.23, due to insufficient input sanitization and outp...

CVE-2024-51661

CVE-2024-51661 affects WordPress Media Library Assistant plugin (versions <= 3.19). It is a OS Command Injection vulnerability caused by improper neutralization of special elements in OS commands, enabling potential remote code execution (RCE). Affected products/versions: Media Library Assistant

CVE-2024-5544

CVE-2024-5544 affects the WordPress plugin Media Library Assistant. The vulnerability is a Reflected Cross-Site Scripting flaw in the order parameter present in all versions up to and including 3.17, caused by insufficient input sanitization and output escaping. The issue enables unauthenticated ...

CVE-2024-6823

The CVE-2024-6823 entry concerns the Media Library Assistant WordPress plugin. It enables arbitrary file uploads due to missing file type validation in the mla-inline-edit-upload-scripts AJAX action, affecting all versions up to 3.18. Exploitation requires authentication at Author level or higher...

CVE-2023-24385

CVE-2023-24385 affects the WordPress Med ia Library Assistant plugin (author+ stored XSS) up to version 3.11. Root cause: insufficient escaping/validation of input leading to stored XSS when an authenticated user with author role submits data. Impact: stored cross-site scripting potential; can af...

CVE-2023-4716

CVE-2023-4716 : The WordPress plugin Media Library Assistant is vulnerable to stored XSS via the mla_gallery shortcode in versions up to 3.10 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level permissions can inject scripts that execute on p...

CVE-2018-20982

The CVE concerns the WordPress plugin Media Library Assistant, affected in versions prior to 2.74. The issue is a cross-site scripting (XSS) vulnerability via the Media/Assistant or Settings/Media Library Assistant admin submenu screens, due to the underlying handling in those interfaces. Impact ...

CVE-2023-34010

CVE-2023-34010 affects WordPress Media Library Assistant plugin (submodule) up to version 3.0.7. The vulnerability is an unauthenticated reflected Cross-Site Scripting (XSS) flaw in a submodule, enabling reflected XSS without authentication. Patch available: upgrade to version 3.0.8, which fixes ...

CVE-2025-7035

CVE-2025-7035 affects the WordPress Media Library Assistant plugin (versions up to and including 3.26). The root cause is insufficient input sanitization and output escaping on mla_tag_cloud and mla_term_list shortcodes, enabling stored XSS. Exploitation requires authenticated access at contribut...