WordPress security by component

Media Library Assistant

Plugin description

Media Library Assistant extends the WordPress media library with advanced organization, categorization, searching, filtering, and media display tools.

Media Library Assistant (media-library-assistant) is a WordPress plugin with 50 published CVE records in this archive. The latest tracked vulnerability was published Oct 29, 2026; the highest published CVSS base score is 9.8.

Plugin slug: media-library-assistant

Latest vulnerability

CVE-2026-118095: Media LIbrary Assistant: DOM-based cross-site scripting

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows DOM-Based XSS.This issue affects Media LIbrary Assistant: from n/a through 3.42. The CNA vector requires low-privilege authenticated access; the exact WordPress role is not disclosed. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Injected script executes in a victim browser when the affected output is rendered; the required viewer role is not disclosed. The CNA vector requires victim interaction; the specific interaction is not disclosed. The structured affected range is <= 3.42.

PublishedOct 29, 2026

Known safe version3.43

Published vulnerabilities for media-library-assistant
		Safe version
Oct 29, 2026	CVE-2026-118095 Media LIbrary Assistant: DOM-based cross-site scripting Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows DOM-Based XSS.This issue affects Media LIbrary Assistant: from n/a through 3.42. The CNA vector requires low-privilege authenticated access; the exact WordPress role is not disclosed. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Injected script executes in a victim browser when the affected output is rendered; the required viewer role is not disclosed. The CNA vector requires victim interaction; the specific interaction is not disclosed. The structured affected range is <= 3.42.	3.43	CVE6.5
Oct 29, 2026	CVE-2026-103875 Media Library Assistant: Reflected cross-site scripting The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search-string' parameter in all versions up to, and including, 3.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted site to have a publicly accessible page containing an [mla_gallery] shortcode configured with a pagination output mode and an mla_link_href template that reflects a {+request:...+} token, along with enough attachments to trigger pagination. The structured affected range is <= 3.42.	3.43	CVE4.7
Oct 28, 2026	CVE-2026-113486 Media Library Assistant: Cross-site request forgery The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on the site. The structured affected range is < 3.42.	3.42	CVE6.5
Oct 28, 2026	CVE-2026-113485 Media Library Assistant: Cross-site request forgery The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to trash or delete attachments. The structured affected range is < 3.42.	3.42	CVE6.5
Oct 26, 2026	CVE-2026-115948 Media LIbrary Assistant: Blind SQL injection Media LIbrary Assistant <= 3.42 permits blind SQL injection: crafted input from a low-privilege authenticated requester can become part of an SQL command without adequate separation from query syntax. The source CVSS vector indicates high confidentiality and low availability impact, consistent with database disclosure and query disruption; it does not establish a database-write primitive. The exact WordPress role, endpoint, input parameter and query-building function are not disclosed.	3.43	CVE8.5
Oct 26, 2026	CVE-2026-115594 Media LIbrary Assistant: Sensitive data exposure Media LIbrary Assistant <= 3.42 includes sensitive information in data sent to a low-privilege authenticated requester. The CVSS vector assigns high confidentiality impact with no victim interaction, but the export does not disclose the endpoint, parameter, minimum WordPress role or the exact information exposed. The disclosure may provide material for a later attack, but the export does not identify credentials, files or a specific exploit chain.	3.43	CVE6.5
Oct 26, 2026	CVE-2026-97295 Media LIbrary Assistant: Cross-site request forgery Media LIbrary Assistant <= 3.42 permits cross-site request forgery: an attacker without an account can cause a victim’s browser to send a request that is accepted without adequate request-origin verification. Victim interaction is required by the supplied CVSS vector. The CVSS vector assigns limited integrity impact, but the export does not identify which plugin action or setting is changed. The target endpoint, parameters and required victim role are not disclosed.	3.43	CVE4.3
Oct 09, 2026	CVE-2026-95609 Media LIbrary Assistant: Stored cross-site scripting The supplied vector requires no attacker account. Attacker-controlled content can be saved and later rendered without sufficient neutralization, allowing script execution under the site's origin in a viewer's session. The export does not identify the input field, storage operation, rendering function, output context or victim role. Victim interaction is required by the vector. The vector reports limited confidentiality impact, limited integrity impact, limited availability impact. Affected versions: <= 3.41. The authoritative export identifies 3.42 as fixed for this CVE.	3.42	CVE7.1
Oct 07, 2026	CVE-2026-97294 Media LIbrary Assistant: Low-privilege stored cross-site scripting An authenticated attacker with low privileges (PR:L) can persist script-capable input that is rendered without sufficient neutralization. Script executes in a victim browser under the site's origin when the affected output is viewed (UI:R). The exact WordPress role, stored field, request endpoint and rendering function are undisclosed; reaching an administrator is conditional on that user viewing the output. Affected versions: <= 3.41. The authoritative export identifies 3.42 as fixed for this CVE.	3.42	CVE6.5
Sep 30, 2026	CVE-2026-97293 Media LIbrary Assistant: SQL injection Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions. Attacker-controlled input can alter database query semantics. The affected query and reachable database data are unspecified; full database compromise is not established. The authoritative export does not identify the vulnerable endpoint, action, parameter or function, so the precise input-to-operation path cannot be established from this snapshot. The authoritative export identifies the fixed release as 3.42.	3.42	CVE8.5
Sep 11, 2026	CVE-2026-6642 Media Library Assistant preset imports permit author stored XSS Media Library Assistant through 3.35 allows an Author with upload_files to place quote-and-attribute payloads in bulk-edit preset fields. Although preset export applies wp_kses() for users without unfiltered_html, the payload needs no HTML tag. When an administrator imports the preset, mla_generate_bulk_edit_form_fieldsets() assigns the stored values to mla-bulk-edit-fieldsets.tpl, which inserts them into input value attributes without esc_attr(). Script executes when the targeted field receives focus.	See mitigation notes	CVE6.4
Sep 11, 2026	CVE-2026-6641 Media Library Assistant gallery links permit contributor stored XSS Media Library Assistant through 3.35 accepts a Contributor-controlled mla_link_href value in the mla_gallery shortcode when mla_output is paginate_links. _paginate_links() passes the value through mla_process_shortcode_parameter() and _replace_query_parameter(), then emits it in href attributes without esc_url(). The stored payload executes when a user views the affected page.	See mitigation notes	CVE6.4
Sep 11, 2026	CVE-2026-6640 Media Library Assistant link attributes permit contributor stored XSS Media Library Assistant through 3.35 does not sufficiently sanitize or escape the Contributor-controlled mla_link_attributes shortcode parameter. An attacker can store script-bearing attributes that execute when a user views the affected page. The authoritative export identifies the parameter but does not disclose the shortcode name, processing function, or exact output context.	See mitigation notes	CVE6.4
Aug 21, 2026	CVE-2026-16959 Media Library Assistant permits Author-level SQL injection Media Library Assistant before 3.40 concatenates an attacker-controlled search value into an SQL query in a media-library query handler without adequate validation. A user with the Author role can therefore perform SQL injection.	3.40	CVE6.8
Aug 20, 2026	CVE-2026-66601 Media Library Assistant permits Subscriber-level cross-site scripting Media Library Assistant <= 3.39 allows a Subscriber to supply script-capable input that reaches browser output without adequate neutralization. The CNA vector requires victim interaction and assigns changed scope with low confidentiality, integrity and availability impact. Script executes in the site's origin when a victim interacts with the affected output.	3.40	CVE6.5
Aug 20, 2026	CVE-2026-66600 Media Library Assistant permits Author-level arbitrary file upload Media Library Assistant <= 3.39 allows an Author to upload an arbitrary file. The CNA prose names Author as the minimum role, while its CVSS vector encodes high privileges required; that inconsistency is unresolved. Executable content could produce code execution where the undisclosed upload path and server configuration permit it; otherwise the primitive still places attacker-controlled content on the server.	3.40	CVE9.1
Aug 18, 2026	CVE-2026-66591 Media Library Assistant permits low-privilege stored cross-site scripting Media Library Assistant through 3.39 lets a low-privilege authenticated user store attacker-controlled content that later executes as script in a victim's browser under the site's origin.	3.40	CVE6.5
Aug 06, 2026	CVE-2026-61963 Media Library Assistant permits unauthenticated cross-site scripting An unauthenticated visitor can submit attacker-controlled content that Media Library Assistant 3.38 and earlier renders without sufficient output encoding, allowing script execution in a victim's browser under the site's origin.	3.39	CVE7.1
Jun 18, 2026	CVE-2026-56012 Media LIbrary Assistant: SQL injection Media LIbrary Assistant is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 3.35.	3.36	CVE8.5
Jun 16, 2026	CVE-2026-54198 Media LIbrary Assistant: Cross-site scripting Media LIbrary Assistant is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 3.35.	3.36	CVE7.1
May 29, 2026	CVE-2026-6075 Media Library Assistant: Cross-site request forgery Media Library Assistant is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The published affected range is <= 3.35.	3.36	CVE8.1
Apr 06, 2026	CVE-2026-34897 Media LIbrary Assistant: Cross-site scripting Media LIbrary Assistant is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 3.34.	3.35	CVE6.5
Apr 06, 2026	CVE-2026-34885 Media LIbrary Assistant: SQL injection Media LIbrary Assistant is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 3.34.	3.35	CVE8.5
Mar 13, 2026	CVE-2026-32399 Media LIbrary Assistant: SQL injection Media LIbrary Assistant is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE8.5
Mar 05, 2026	CVE-2026-3072 Media Library Assistant: A security weakness Media Library Assistant is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3
Dec 09, 2025	CVE-2025-63065 Media LIbrary Assistant: A security weakness Media LIbrary Assistant is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3
Oct 18, 2025	CVE-2025-11738 Media Library Assistant: A security weakness Media Library Assistant is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3
Sep 22, 2025	CVE-2025-59590 Media LIbrary Assistant: Cross-site scripting Media LIbrary Assistant is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9
Aug 19, 2025	CVE-2025-8357 Media Library Assistant: Arbitrary file deletion Media Library Assistant is affected by arbitrary file deletion. Exploitation requires an authenticated author account. A successful request can remove files outside the intended scope and may make the site unavailable.	See mitigation notes	CVE4.3
Jul 16, 2025	CVE-2025-7035 Media Library Assistant: Cross-site scripting Media Library Assistant is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Mar 31, 2025	CVE-2025-31627 Media LIbrary Assistant: Cross-site scripting Media LIbrary Assistant is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9
Jan 04, 2025	CVE-2024-11974 Media Library Assistant: Cross-site scripting Media Library Assistant is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.1
Nov 04, 2024	CVE-2024-51661 Media LIbrary Assistant: A security weakness Media LIbrary Assistant is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE9.1
Aug 13, 2024	CVE-2024-6823 Media Library Assistant: Dangerous file upload Media Library Assistant is affected by dangerous file upload. Exploitation requires an authenticated author account. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.	See mitigation notes	CVE8.8
Jul 02, 2024	CVE-2024-5544 Media Library Assistant: Cross-site scripting Media Library Assistant is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.1
Jun 20, 2024	CVE-2024-5605 Media Library Assistant: SQL injection Media Library Assistant is affected by SQL injection. Exploitation requires an authenticated contributor account. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE8.8
May 22, 2024	CVE-2024-3519 Media Library Assistant: Cross-site scripting Media Library Assistant is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.1
May 22, 2024	CVE-2024-3518 Media Library Assistant: SQL injection Media Library Assistant is affected by SQL injection. Exploitation requires an authenticated contributor account. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE8.8
Apr 09, 2024	CVE-2024-2871 Media Library Assistant: SQL injection Media Library Assistant is affected by SQL injection. Exploitation requires an authenticated contributor account. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE6.4
Mar 29, 2024	CVE-2024-2475 Media Library Assistant: Cross-site scripting Media Library Assistant is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Oct 17, 2023	CVE-2023-24385 Media Library Assistant: Cross-site scripting Media Library Assistant is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9
Sep 22, 2023	CVE-2023-4716 Media Library Assistant: Cross-site scripting Media Library Assistant is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Sep 06, 2023	CVE-2023-4634 Media Library Assistant: Filesystem traversal Media Library Assistant is affected by filesystem traversal. The vulnerable path is reachable without authentication. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE9.8
Aug 05, 2023	CVE-2023-34010 Media Library Assistant: Cross-site scripting Media Library Assistant is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.8
Feb 27, 2023	CVE-2023-0279 Media Library Assistant: SQL injection Media Library Assistant is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE7.2
Nov 18, 2022	CVE-2022-41618 Media Library Assistant: A security weakness Media Library Assistant is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE3.7
Apr 20, 2020	CVE-2020-11928 Media Library Assistant: Code execution Media Library Assistant is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVEPending
Apr 13, 2020	CVE-2020-11732 Media Library Assistant: Filesystem traversal Media Library Assistant is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVEPending
Apr 13, 2020	CVE-2020-11731 Media Library Assistant: Cross-site scripting Media Library Assistant is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending
Aug 22, 2019	CVE-2018-20982 Media Library Assistant: Cross-site scripting Media Library Assistant is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers