WordPress security by component
Media LIbrary Assistant
Plugin description
Media LIbrary Assistant is a WordPress component with 32 published CVE records in this archive. The latest tracked vulnerability was published Jun 18, 2026; the highest CVE/CNA score is 9.8.
Plugin slug:
media-library-assistantLatest vulnerability
CVE-2026-56012: Media LIbrary Assistant: SQL injection
Media LIbrary Assistant is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 3.35.
| Safe version |
|
||
|---|---|---|---|
| Jun 18, 2026 |
CVE-2026-56012
Media LIbrary Assistant: SQL injection
Media LIbrary Assistant is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 3.35.
|
3.36 |
CVE8.5
NVDPending
|
| Jun 16, 2026 |
CVE-2026-54198
Media LIbrary Assistant: Cross-site scripting
Media LIbrary Assistant is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 3.35.
|
3.36 |
CVE7.1
NVDPending
|
| May 29, 2026 |
CVE-2026-6075
Media Library Assistant: Cross-site request forgery
Media Library Assistant is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The published affected range is <= 3.35.
|
> 3.35 |
CVE8.1
NVDPending
|
| Apr 06, 2026 |
CVE-2026-34897
Media LIbrary Assistant: Cross-site scripting
Media LIbrary Assistant is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 3.34.
|
3.35 |
CVE6.5
NVDPending
|
| Apr 06, 2026 |
CVE-2026-34885
Media LIbrary Assistant: SQL injection
Media LIbrary Assistant is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 3.34.
|
3.35 |
CVE8.5
NVDPending
|
| Mar 13, 2026 |
CVE-2026-32399
Media LIbrary Assistant: SQL injection
Media LIbrary Assistant is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE8.5
NVDPending
|
| Mar 05, 2026 |
CVE-2026-3072
Media Library Assistant: A security weakness
Media Library Assistant is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Dec 09, 2025 |
CVE-2025-63065
Media LIbrary Assistant: A security weakness
Media LIbrary Assistant is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Oct 18, 2025 |
CVE-2025-11738
Media Library Assistant: A security weakness
Media Library Assistant is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Sep 22, 2025 |
CVE-2025-59590
Media LIbrary Assistant: Cross-site scripting
Media LIbrary Assistant is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.9
NVDPending
|
| Aug 19, 2025 |
CVE-2025-8357
Media Library Assistant: Arbitrary file deletion
Media Library Assistant is affected by arbitrary file deletion. Exploitation requires at least author-level access. A successful request can remove files outside the intended scope and may make the site unavailable.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Jul 16, 2025 |
CVE-2025-7035
Media Library Assistant: Cross-site scripting
Media Library Assistant is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Mar 31, 2025 |
CVE-2025-31627
Media LIbrary Assistant: Cross-site scripting
Media LIbrary Assistant is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.9
NVDPending
|
| Jan 04, 2025 |
CVE-2024-11974
Media Library Assistant: Cross-site scripting
Media Library Assistant is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVDPending
|
| Nov 04, 2024 |
CVE-2024-51661
Media LIbrary Assistant: A security weakness
Media LIbrary Assistant is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE9.1
NVD7.2
|
| Aug 13, 2024 |
CVE-2024-6823
Media Library Assistant: Dangerous file upload
Media Library Assistant is affected by dangerous file upload. Exploitation requires at least author-level access. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
|
See mitigation notes |
CVE8.8
NVDPending
|
| Jul 02, 2024 |
CVE-2024-5544
Media Library Assistant: Cross-site scripting
Media Library Assistant is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|
| Jun 20, 2024 |
CVE-2024-5605
Media Library Assistant: SQL injection
Media Library Assistant is affected by SQL injection. Exploitation requires at least contributor-level access. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE8.8
NVDPending
|
| May 22, 2024 |
CVE-2024-3519
Media Library Assistant: Cross-site scripting
Media Library Assistant is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVDPending
|
| May 22, 2024 |
CVE-2024-3518
Media Library Assistant: SQL injection
Media Library Assistant is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE8.8
NVD6.5
|
| Apr 09, 2024 |
CVE-2024-2871
Media Library Assistant: SQL injection
Media Library Assistant is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE6.4
NVD7.7
|
| Mar 29, 2024 |
CVE-2024-2475
Media Library Assistant: Cross-site scripting
Media Library Assistant is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Oct 17, 2023 |
CVE-2023-24385
Media Library Assistant: Cross-site scripting
Media Library Assistant is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.9
NVD4.8
|
| Sep 22, 2023 |
CVE-2023-4716
Media Library Assistant: Cross-site scripting
Media Library Assistant is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Sep 06, 2023 |
CVE-2023-4634
Media Library Assistant: Filesystem traversal
Media Library Assistant is affected by filesystem traversal. The vulnerable path is reachable without authentication. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE9.8
NVDPending
|
| Aug 05, 2023 |
CVE-2023-34010
Media Library Assistant: Cross-site scripting
Media Library Assistant is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.8
NVD6.1
|
| Feb 27, 2023 |
CVE-2023-0279
Media Library Assistant: SQL injection
Media Library Assistant is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE7.2
NVD7.2
|
| Nov 18, 2022 |
CVE-2022-41618
Media Library Assistant: A security weakness
Media Library Assistant is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE3.7
NVD5.3
|
| Apr 20, 2020 |
CVE-2020-11928
Media Library Assistant: Code execution
Media Library Assistant is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE9.8
NVD9.8
|
| Apr 13, 2020 |
CVE-2020-11732
Media Library Assistant: Filesystem traversal
Media Library Assistant is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE7.5
NVD7.5
|
| Apr 13, 2020 |
CVE-2020-11731
Media Library Assistant: Cross-site scripting
Media Library Assistant is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|
| Aug 22, 2019 |
CVE-2018-20982
Media Library Assistant: Cross-site scripting
Media Library Assistant is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|