WordPress security by component

Media Library Assistant

Plugin description

Media Library Assistant extends the WordPress media library with advanced organization, categorization, searching, filtering, and media display tools.

Media Library Assistant (media-library-assistant) is a WordPress plugin with 40 published CVE records in this archive. The latest tracked vulnerability was published Sep 11, 2026; the highest published CVSS base score is 9.8.

Plugin slug: media-library-assistant

Latest vulnerability

CVE-2026-6642: Media Library Assistant preset imports permit author stored XSS

Media Library Assistant through 3.35 allows an Author with upload_files to place quote-and-attribute payloads in bulk-edit preset fields. Although preset export applies wp_kses() for users without unfiltered_html, the payload needs no HTML tag. When an administrator imports the preset, mla_generate_bulk_edit_form_fieldsets() assigns the stored values to mla-bulk-edit-fieldsets.tpl, which inserts them into input value attributes without esc_attr(). Script executes when the targeted field receives focus.

PublishedSep 11, 2026

Safe version guidanceSee mitigation notes

Published vulnerabilities for media-library-assistant
		Safe version
Sep 11, 2026	CVE-2026-6642 Media Library Assistant preset imports permit author stored XSS Media Library Assistant through 3.35 allows an Author with upload_files to place quote-and-attribute payloads in bulk-edit preset fields. Although preset export applies wp_kses() for users without unfiltered_html, the payload needs no HTML tag. When an administrator imports the preset, mla_generate_bulk_edit_form_fieldsets() assigns the stored values to mla-bulk-edit-fieldsets.tpl, which inserts them into input value attributes without esc_attr(). Script executes when the targeted field receives focus.	See mitigation notes	CVE6.4 NVDPending
Sep 11, 2026	CVE-2026-6641 Media Library Assistant gallery links permit contributor stored XSS Media Library Assistant through 3.35 accepts a Contributor-controlled mla_link_href value in the mla_gallery shortcode when mla_output is paginate_links. _paginate_links() passes the value through mla_process_shortcode_parameter() and _replace_query_parameter(), then emits it in href attributes without esc_url(). The stored payload executes when a user views the affected page.	See mitigation notes	CVE6.4 NVDPending
Sep 11, 2026	CVE-2026-6640 Media Library Assistant link attributes permit contributor stored XSS Media Library Assistant through 3.35 does not sufficiently sanitize or escape the Contributor-controlled mla_link_attributes shortcode parameter. An attacker can store script-bearing attributes that execute when a user views the affected page. The authoritative export identifies the parameter but does not disclose the shortcode name, processing function, or exact output context.	See mitigation notes	CVE6.4 NVDPending
Aug 21, 2026	CVE-2026-16959 Media Library Assistant permits Author-level SQL injection Media Library Assistant before 3.40 concatenates an attacker-controlled search value into an SQL query in a media-library query handler without adequate validation. A user with the Author role can therefore perform SQL injection.	3.40	CVE6.8 NVDPending
Aug 20, 2026	CVE-2026-66601 Media Library Assistant permits Subscriber-level cross-site scripting Media Library Assistant <= 3.39 allows a Subscriber to supply script-capable input that reaches browser output without adequate neutralization. The CNA vector requires victim interaction and assigns changed scope with low confidentiality, integrity and availability impact. Script executes in the site's origin when a victim interacts with the affected output.	3.40	CVE6.5 NVDPending
Aug 20, 2026	CVE-2026-66600 Media Library Assistant permits Author-level arbitrary file upload Media Library Assistant <= 3.39 allows an Author to upload an arbitrary file. The CNA prose names Author as the minimum role, while its CVSS vector encodes high privileges required; that inconsistency is unresolved. Executable content could produce code execution where the undisclosed upload path and server configuration permit it; otherwise the primitive still places attacker-controlled content on the server.	3.40	CVE9.1 NVDPending
Aug 18, 2026	CVE-2026-66591 Media Library Assistant permits low-privilege stored cross-site scripting Media Library Assistant through 3.39 lets a low-privilege authenticated user store attacker-controlled content that later executes as script in a victim's browser under the site's origin.	3.40	CVE6.5 NVDPending
Aug 06, 2026	CVE-2026-61963 Media Library Assistant permits unauthenticated cross-site scripting An unauthenticated visitor can submit attacker-controlled content that Media Library Assistant 3.38 and earlier renders without sufficient output encoding, allowing script execution in a victim's browser under the site's origin.	3.39	CVE7.1 NVDPending
Jun 18, 2026	CVE-2026-56012 Media LIbrary Assistant: SQL injection Media LIbrary Assistant is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 3.35.	3.36	CVE8.5 NVDPending
Jun 16, 2026	CVE-2026-54198 Media LIbrary Assistant: Cross-site scripting Media LIbrary Assistant is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 3.35.	3.36	CVE7.1 NVDPending
May 29, 2026	CVE-2026-6075 Media Library Assistant: Cross-site request forgery Media Library Assistant is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The published affected range is <= 3.35.	3.36	CVE8.1 NVDPending
Apr 06, 2026	CVE-2026-34897 Media LIbrary Assistant: Cross-site scripting Media LIbrary Assistant is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 3.34.	3.35	CVE6.5 NVDPending
Apr 06, 2026	CVE-2026-34885 Media LIbrary Assistant: SQL injection Media LIbrary Assistant is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 3.34.	3.35	CVE8.5 NVDPending
Mar 13, 2026	CVE-2026-32399 Media LIbrary Assistant: SQL injection Media LIbrary Assistant is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE8.5 NVDPending
Mar 05, 2026	CVE-2026-3072 Media Library Assistant: A security weakness Media Library Assistant is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3 NVDPending
Dec 09, 2025	CVE-2025-63065 Media LIbrary Assistant: A security weakness Media LIbrary Assistant is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending
Oct 18, 2025	CVE-2025-11738 Media Library Assistant: A security weakness Media Library Assistant is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending
Sep 22, 2025	CVE-2025-59590 Media LIbrary Assistant: Cross-site scripting Media LIbrary Assistant is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9 NVDPending
Aug 19, 2025	CVE-2025-8357 Media Library Assistant: Arbitrary file deletion Media Library Assistant is affected by arbitrary file deletion. Exploitation requires an authenticated author account. A successful request can remove files outside the intended scope and may make the site unavailable.	See mitigation notes	CVE4.3 NVDPending
Jul 16, 2025	CVE-2025-7035 Media Library Assistant: Cross-site scripting Media Library Assistant is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
Mar 31, 2025	CVE-2025-31627 Media LIbrary Assistant: Cross-site scripting Media LIbrary Assistant is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9 NVDPending
Jan 04, 2025	CVE-2024-11974 Media Library Assistant: Cross-site scripting Media Library Assistant is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.1 NVDPending
Nov 04, 2024	CVE-2024-51661 Media LIbrary Assistant: A security weakness Media LIbrary Assistant is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE9.1 NVD7.2
Aug 13, 2024	CVE-2024-6823 Media Library Assistant: Dangerous file upload Media Library Assistant is affected by dangerous file upload. Exploitation requires an authenticated author account. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.	See mitigation notes	CVE8.8 NVDPending
Jul 02, 2024	CVE-2024-5544 Media Library Assistant: Cross-site scripting Media Library Assistant is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.1 NVD6.1
Jun 20, 2024	CVE-2024-5605 Media Library Assistant: SQL injection Media Library Assistant is affected by SQL injection. Exploitation requires an authenticated contributor account. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE8.8 NVDPending
May 22, 2024	CVE-2024-3519 Media Library Assistant: Cross-site scripting Media Library Assistant is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.1 NVDPending
May 22, 2024	CVE-2024-3518 Media Library Assistant: SQL injection Media Library Assistant is affected by SQL injection. Exploitation requires an authenticated contributor account. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE8.8 NVD6.5
Apr 09, 2024	CVE-2024-2871 Media Library Assistant: SQL injection Media Library Assistant is affected by SQL injection. Exploitation requires an authenticated contributor account. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE6.4 NVD7.7
Mar 29, 2024	CVE-2024-2475 Media Library Assistant: Cross-site scripting Media Library Assistant is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
Oct 17, 2023	CVE-2023-24385 Media Library Assistant: Cross-site scripting Media Library Assistant is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9 NVD4.8
Sep 22, 2023	CVE-2023-4716 Media Library Assistant: Cross-site scripting Media Library Assistant is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
Sep 06, 2023	CVE-2023-4634 Media Library Assistant: Filesystem traversal Media Library Assistant is affected by filesystem traversal. The vulnerable path is reachable without authentication. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE9.8 NVDPending
Aug 05, 2023	CVE-2023-34010 Media Library Assistant: Cross-site scripting Media Library Assistant is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.8 NVD6.1
Feb 27, 2023	CVE-2023-0279 Media Library Assistant: SQL injection Media Library Assistant is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE7.2 NVD7.2
Nov 18, 2022	CVE-2022-41618 Media Library Assistant: A security weakness Media Library Assistant is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE3.7 NVD5.3
Apr 20, 2020	CVE-2020-11928 Media Library Assistant: Code execution Media Library Assistant is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVEPending NVD9.8
Apr 13, 2020	CVE-2020-11732 Media Library Assistant: Filesystem traversal Media Library Assistant is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVEPending NVD7.5
Apr 13, 2020	CVE-2020-11731 Media Library Assistant: Cross-site scripting Media Library Assistant is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD6.1
Aug 22, 2019	CVE-2018-20982 Media Library Assistant: Cross-site scripting Media Library Assistant is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD6.1

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers