David Lingren
Monthly
Arbitrary file upload in the Media Library Assistant WordPress plugin (versions 3.39 and earlier) lets an authenticated user with Author-level access upload files of dangerous types, typically leading to remote code execution and full site compromise. The flaw was reported by Patchstack and is tracked as CWE-434; no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV. The CVSS 9.1 rating reflects the high impact and scope change, though the practical barrier is that an attacker must already hold an Author account.
Unauthenticated Cross-Site Scripting (XSS) in the Media Library Assistant WordPress plugin affects all versions up to and including 3.38, allowing remote attackers without any authentication to inject malicious scripts into pages viewed by victims. The scope change indicated by the CVSS vector (S:C) suggests the injected script executes in a security context beyond the plugin itself, potentially enabling session hijacking, credential theft, or malicious redirects against authenticated WordPress users including administrators. No public exploit code or active exploitation has been confirmed at time of analysis, but the unauthenticated nature and low attack complexity elevate practical risk on exposed WordPress installations.
Reflected cross-site scripting in the Media Library Assistant WordPress plugin (versions up to and including 3.35) allows unauthenticated remote attackers to inject script that executes in a victim's browser after a user-interaction event (clicking a crafted link). Per Patchstack, the issue affects David Lingren's plugin and currently has no public exploit identified at time of analysis, but the CVSS 7.1 (scope-changed) reflects that successful execution can pivot into authenticated admin contexts.
Blind SQL injection in Media Library Assistant through version 3.32 allows authenticated attackers to execute arbitrary SQL queries over the network, potentially leading to unauthorized data access and service disruption. The vulnerability requires valid user credentials but no user interaction, making it exploitable by internal or compromised accounts with minimal effort. No patch is currently available for affected installations.
Cross-site scripting in the Media Library Assistant WordPress plugin (versions up to and including 3.39) allows a subscriber-level authenticated user to inject malicious scripts into the media library that execute in the browser session of a higher-privileged user, such as an administrator, who subsequently views the affected content. The scope change indicated by the CVSS vector (S:C) means successful exploitation crosses from the plugin context into the victim's browser, enabling session hijacking or privilege escalation within the WordPress installation. No public exploit code or active exploitation has been identified at time of analysis.
Arbitrary file upload in the Media Library Assistant WordPress plugin (versions 3.39 and earlier) lets an authenticated user with Author-level access upload files of dangerous types, typically leading to remote code execution and full site compromise. The flaw was reported by Patchstack and is tracked as CWE-434; no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV. The CVSS 9.1 rating reflects the high impact and scope change, though the practical barrier is that an attacker must already hold an Author account.
Unauthenticated Cross-Site Scripting (XSS) in the Media Library Assistant WordPress plugin affects all versions up to and including 3.38, allowing remote attackers without any authentication to inject malicious scripts into pages viewed by victims. The scope change indicated by the CVSS vector (S:C) suggests the injected script executes in a security context beyond the plugin itself, potentially enabling session hijacking, credential theft, or malicious redirects against authenticated WordPress users including administrators. No public exploit code or active exploitation has been confirmed at time of analysis, but the unauthenticated nature and low attack complexity elevate practical risk on exposed WordPress installations.
Reflected cross-site scripting in the Media Library Assistant WordPress plugin (versions up to and including 3.35) allows unauthenticated remote attackers to inject script that executes in a victim's browser after a user-interaction event (clicking a crafted link). Per Patchstack, the issue affects David Lingren's plugin and currently has no public exploit identified at time of analysis, but the CVSS 7.1 (scope-changed) reflects that successful execution can pivot into authenticated admin contexts.
Blind SQL injection in Media Library Assistant through version 3.32 allows authenticated attackers to execute arbitrary SQL queries over the network, potentially leading to unauthorized data access and service disruption. The vulnerability requires valid user credentials but no user interaction, making it exploitable by internal or compromised accounts with minimal effort. No patch is currently available for affected installations.
Cross-site scripting in the Media Library Assistant WordPress plugin (versions up to and including 3.39) allows a subscriber-level authenticated user to inject malicious scripts into the media library that execute in the browser session of a higher-privileged user, such as an administrator, who subsequently views the affected content. The scope change indicated by the CVSS vector (S:C) means successful exploitation crosses from the plugin context into the victim's browser, enabling session hijacking or privilege escalation within the WordPress installation. No public exploit code or active exploitation has been identified at time of analysis.