Login Request a demo
ML
Product
Media Library Assistant
by Davidlingren · last CVE Jul 16, 2025
19
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities19In the news0Timeline
Severity mix
Critical 2High 5Medium 12Low 0
Severity
All severities19Critical2High5Medium12Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Media Library Assistant to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-4634
9.8
86%
Sep 6
Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution
Affected: before 3.10
CVE-2020-11928
9.8
4%
Apr 20
In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_query parameter in mla_gallery via an admin
Affected: before 2.82
CVE-2024-6823
8.8
1%
Aug 13
Media Library Assistant <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action
Affected: before 3.19
CVE-2024-5605
8.8
1%
Jun 20
Media Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameter
Affected: before 3.17
CVE-2024-2871
7.7
0%
Apr 9
Media Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcode
Affected: before 3.14
CVE-2020-11732
7.5
5%
Apr 13
The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_gallery link=download
Affected: before 2.82
CVE-2024-51661
7.2
1%
Nov 4
WordPress Media Library Assistant plugin <= 3.19 - Remote Code Execution (RCE) vulnerability
Affected: before 3.20
CVE-2024-3518
6.5
1%
May 21
Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode
Affected: before 3.16
CVE-2024-11974
6.1
0%
Jan 4
Media Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters
Affected: through 3.23
CVE-2024-5544
6.1
0%
Jul 2
Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting
Affected: before 3.18
CVE-2024-3519
6.1
0%
May 21
Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang
Affected: before 3.16
CVE-2023-34010
6.1
0%
Aug 5
WordPress Media Library Assistant Plugin <= 3.0.7 is vulnerable to Cross Site Scripting (XSS)
Affected: through 3.0.7
CVE-2020-11731
6.1
1%
Apr 13
The Media Library Assistant plugin before 2.82 for Wordpress suffers from multiple XSS vulnerabilities in all Settings/Media Library Assistant tabs, which allow remote…
Affected: before 2.82
CVE-2018-20982
6.1
1%
Aug 22
The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens
Affected: before 2.74
CVE-2025-7035
5.4
0%
Jul 16
Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes
Affected: before 3.27
CVE-2024-2475
5.4
0%
Mar 29
Media Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode
Affected: before 3.14
CVE-2023-4716
5.4
1%
Sep 22
Media Library Assistant <= 3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Affected: through 3.10
CVE-2022-41618
5.3
1%
Nov 18
WordPress Media Library Assistant plugin <= 3.00 - Unauthenticated Error Log Disclosure vulnerability
Affected: before 3.01
CVE-2023-24385
4.8
0%
Oct 17
WordPress Media Library Assistant Plugin <= 3.11 is vulnerable to Cross Site Scripting (XSS)
Affected: before 3.12
Showing 19