VendorsDavid Lingrenmedia_library_assistantall versions

Vulnerabilities

David Lingren Media Library Assistant

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

19CVEs

CVE-2023-4634

Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution

Published 2023-09-06 · Modified

9.81 PoCEPSS 0.859

CVE-2020-11928

In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_query parameter in mla_gallery via an admin.

Published 2020-04-19 · Modified

9.8EPSS 0.036

CVE-2024-51661

WordPress Media Library Assistant plugin <= 3.19 - Remote Code Execution (RCE) vulnerability

Published 2024-11-04 · Modified

9.1EPSS 0.011

CVE-2024-6823

Media Library Assistant <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action

Published 2024-08-13 · Analyzed

8.8EPSS 0.013

CVE-2024-5605

Media Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameter

Published 2024-06-20 · Modified

8.8EPSS 0.006

CVE-2024-3518

Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode

Published 2024-05-21 · Modified

8.8EPSS 0.005

CVE-2024-2871

Media Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcode

Published 2024-04-09 · Modified

7.7EPSS 0.005

CVE-2020-11732

The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_gallery link=download.

Published 2020-04-13 · Modified

7.5EPSS 0.049

CVE-2023-4716

Media Library Assistant <= 3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published 2023-09-22 · Modified

6.4EPSS 0.005

CVE-2024-2475

Media Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode

Published 2024-03-29 · Modified

6.4EPSS 0.004

CVE-2025-7035

Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes

Published 2025-07-16 · Analyzed

6.4EPSS 0.003

CVE-2020-11731

The Media Library Assistant plugin before 2.82 for Wordpress suffers from multiple XSS vulnerabilities in all Settings/Media Library Assistant tabs, which allow remote authenticated users to execute arbitrary JavaScript.

Published 2020-04-13 · Modified

6.1EPSS 0.012

CVE-2018-20982

The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens.

Published 2019-08-22 · Modified

6.1EPSS 0.009

CVE-2024-11974

Media Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters

Published 2025-01-04 · Analyzed

6.1EPSS 0.004

CVE-2023-34010

WordPress Media Library Assistant Plugin <= 3.0.7 is vulnerable to Cross Site Scripting (XSS)

Published 2023-08-05 · Modified

6.1EPSS 0.004

CVE-2024-5544

Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting