Login Request a demo
ML
Product
Media Library Assistant
by dglingren · last CVE Oct 29, 2026
17
CVEs
0
On KEV
8.8
Max CVSS
1
New 30D
Vulnerabilities17In the news0Timeline
Severity mix
Critical 0High 4Medium 13Low 0
Severity
All severities17Critical0High4Medium13Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Media Library Assistant to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-3518
6.5
1%
May 21
Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode
Affected: through 3.15
CVE-2026-6640
6.4
0%
Sep 11
Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter
Affected: through 3.35
CVE-2026-6642
6.4
0%
Sep 11
Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import
Affected: through 3.35
CVE-2026-6641
6.4
0%
Sep 11
Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter
Affected: through 3.35
CVE-2024-11974
6.1
0%
Jan 4
Media Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters
Affected: through 3.23
CVE-2024-5544
6.1
0%
Jul 2
Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting
Affected: through 3.17
CVE-2024-3519
6.1
0%
May 21
Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang
Affected: through 3.15
CVE-2025-7035
5.4
0%
Jul 16
Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes
Affected: through 3.26
CVE-2024-2475
5.4
0%
Mar 29
Media Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode
Affected: through 3.13
CVE-2025-11738
5.3
0%
Oct 18
Media Library Assistant <= 3.29 - Unauthenticated Limited File Read
Affected: through 3.29
CVE-2026-103875
New
4.7–Oct 29
Media Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links
Affected: through 3.42
CVE-2026-3072
4.3
0%
Mar 5
Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification
Affected: through 3.33
CVE-2025-8357
4.3
0%
Aug 19
Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion
Affected: through 3.27
Showing 13