Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Media LIbrary Assistant — Vulnerabilities & Security Advisories 27

All 27 CVE vulnerabilities found in Media LIbrary Assistant, with AI-generated Chinese analysis, references, and POCs.

The Media Library Assistant vulnerability aggregation page provides a comprehensive view of security weaknesses affecting this WordPress plugin. This resource collects data on Common Weakness Enumeration (CWE) classifications, specifically focusing on issues related to insecure file handling, privilege escalation, and cross-site scripting within the media library management context. The data currently covers security advisories and vulnerability disclosures published between January 2020 and December 2023, ensuring a robust historical record for analysis. Users can utilize this page to track vendor advisories issued by the developer, allowing for timely updates and patch management decisions. It enables security researchers and administrators to understand specific weakness classes prevalent in the plugin’s codebase, such as improper input validation or unauthorized file uploads. Furthermore, one can look up the product's vulnerability history to identify patterns in reported flaws over time, which aids in assessing the long-term maintenance quality and security posture of the software. This aggregated view supports informed risk assessment by highlighting recurring issues rather than isolated incidents. By centralizing this information, the page facilitates better compliance auditing and proactive defense strategies against known exploits targeting this specific media management tool.

Vendor: Unknown

CVE IDTitleCVSSSeverityPublished
CVE-2026-56012 WordPress Media LIbrary Assistant plugin <= 3.35 - SQL Injection vulnerability CWE-89 8.5 High2026-06-18
CVE-2026-54198 WordPress Media LIbrary Assistant plugin <= 3.35 - Reflected Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High2026-06-16
CVE-2026-6075 Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form CWE-352 8.1 High2026-05-29
CVE-2026-34897 WordPress Media LIbrary Assistant plugin <= 3.34 - Cross Site Scripting (XSS) vulnerability CWE-79 6.5 Medium2026-04-06
CVE-2026-34885 WordPress Media LIbrary Assistant plugin <= 3.34 - SQL Injection vulnerability CWE-89 8.5 High2026-04-06
CVE-2026-32399 WordPress Media LIbrary Assistant plugin <= 3.32 - SQL Injection vulnerability CWE-89 8.5 High2026-03-13
CVE-2026-3072 Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification CWE-862 4.3 Medium2026-03-05
CVE-2025-63065 WordPress Media LIbrary Assistant plugin <= 3.29 - Broken Access Control vulnerability CWE-639 5.3 Medium2025-12-09
CVE-2025-11738 Media Library Assistant <= 3.29 - Unauthenticated Limited File Read CWE-73 5.3 Medium2025-10-18
CVE-2025-59590 WordPress Media Library Assistant Plugin <= 3.28 - Cross Site Scripting (XSS) Vulnerability CWE-79 5.9 Medium2025-09-22
CVE-2025-8357 Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion CWE-862 4.3 Medium2025-08-19
CVE-2025-7035 Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes CWE-79 6.4 Medium2025-07-16
CVE-2025-31627 WordPress Media Library Assistant plugin <= 3.24 - Stored Cross Site Scripting (XSS) vulnerability CWE-79 5.9 Medium2025-03-31
CVE-2024-11974 Media Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters CWE-79 6.1 Medium2025-01-04
CVE-2024-51661 WordPress Media Library Assistant plugin <= 3.19 - Remote Code Execution (RCE) vulnerability CWE-78 9.1 Critical2024-11-04
CVE-2024-6823 Media Library Assistant <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action CWE-434 8.8 High2024-08-13
CVE-2024-5544 Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting CWE-79 6.1 Medium2024-07-02
CVE-2024-5605 Media Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameter CWE-89 8.8 High2024-06-20
CVE-2024-3518 Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode CWE-89 8.8 High2024-05-21
CVE-2024-3519 Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang CWE-87 6.1 Medium2024-05-21
CVE-2024-2871 Media Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcode CWE-89 6.4 Medium2024-04-09
CVE-2024-2475 Media Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode CWE-79 6.4 Medium2024-03-29
CVE-2023-24385 WordPress Media Library Assistant Plugin <= 3.11 is vulnerable to Cross Site Scripting (XSS) CWE-79 5.9 Medium2023-10-17
CVE-2023-4716 Media Library Assistant <= 3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CWE-79 6.4 Medium2023-09-22
CVE-2023-4634 Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution CWE-73 9.8 Critical2023-09-06
CVE-2023-34010 WordPress Media Library Assistant Plugin <= 3.0.7 is vulnerable to Cross Site Scripting (XSS) CWE-79 5.8 Medium2023-08-05
CVE-2023-0279 Media Library Assistant < 3.06 - Admin+ SQLi 7.2 -2023-02-27

All 27 known CVE vulnerabilities affecting Media LIbrary Assistant with full Chinese analysis, references, and POCs where available.