David Lingren
Monthly
Blind SQL injection in the WordPress plugin Media Library Assistant through version 3.42 allows an authenticated low-privileged user to read sensitive data from the site database; the assessed impact is confidentiality-only. The issue is network-reachable with no user interaction required, but exploitation is gated by a valid account (PR:L) and the specific injectable endpoint or parameter is not named in the available sources. No public exploit code has been identified at time of analysis, and the issue carries a this_week priority rather than an emergency designation.
Stored cross-site scripting in the WordPress plugin Media Library Assistant (versions through 3.41) allows an attacker to persist a crafted script payload into media item metadata or attachment fields that the plugin later renders in the admin interface, where it executes in the browser context of an administrator or editor who loads the affected page. Exploitation is not fully self-contained: it requires user interaction (the victim must view the poisoned page) and, consistent with our assessed vector (PR:L rather than the CVE record's PR:N), realistically requires the attacker to hold some content-submission capability on the target site in order to store the payload. Impact is limited to low confidentiality, integrity, and availability within the victim's browser session, and no public exploit or confirmed active exploitation was identified at time of analysis.
SQL injection in the WordPress plugin Media Library Assistant (version 3.41 and earlier) allows an authenticated Contributor-level account to inject arbitrary SQL into the plugin's media/attachment query handling, reading database content such as user password hashes, private or draft posts, and stored configuration secrets. The issue is remotely exploitable with low complexity and no user interaction, and the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) yields a base score of 8.5 (High), reflecting confidentiality-only impact plus a scope change that lets the injection reach tables outside the plugin itself. There is no public exploit identified at time of analysis and no CISA KEV entry, so the practical barrier to abuse is obtaining a Contributor account - realistic on sites with open registration, multi-author blogs, or guest-post/membership setups, but not on locked-down single-admin installs.
Arbitrary file upload in the Media Library Assistant WordPress plugin (versions 3.39 and earlier) lets an authenticated user with Author-level access upload files of dangerous types, typically leading to remote code execution and full site compromise. The flaw was reported by Patchstack and is tracked as CWE-434; no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV. The CVSS 9.1 rating reflects the high impact and scope change, though the practical barrier is that an attacker must already hold an Author account.
Unauthenticated Cross-Site Scripting (XSS) in the Media Library Assistant WordPress plugin affects all versions up to and including 3.38, allowing remote attackers without any authentication to inject malicious scripts into pages viewed by victims. The scope change indicated by the CVSS vector (S:C) suggests the injected script executes in a security context beyond the plugin itself, potentially enabling session hijacking, credential theft, or malicious redirects against authenticated WordPress users including administrators. No public exploit code or active exploitation has been confirmed at time of analysis, but the unauthenticated nature and low attack complexity elevate practical risk on exposed WordPress installations.
Reflected cross-site scripting in the Media Library Assistant WordPress plugin (versions up to and including 3.35) allows unauthenticated remote attackers to inject script that executes in a victim's browser after a user-interaction event (clicking a crafted link). Per Patchstack, the issue affects David Lingren's plugin and currently has no public exploit identified at time of analysis, but the CVSS 7.1 (scope-changed) reflects that successful execution can pivot into authenticated admin contexts.
Blind SQL injection in Media Library Assistant through version 3.32 allows authenticated attackers to execute arbitrary SQL queries over the network, potentially leading to unauthorized data access and service disruption. The vulnerability requires valid user credentials but no user interaction, making it exploitable by internal or compromised accounts with minimal effort. No patch is currently available for affected installations.
DOM-based cross-site scripting in the Media Library Assistant WordPress plugin, affecting versions through 3.42, lets an authenticated low-privilege user plant script that runs in a victim's browser once that victim interacts with the attacker-influenced content. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, score 6.5) shows this is not unauthenticated against a default install: it needs a pre-existing WordPress account plus victim interaction, and the scope change means the injected script can act beyond the plugin's own origin context. No public exploit was identified at time of analysis and there is no KEV entry; the priority label is this_month.
Sensitive information disclosure in the WordPress plugin Media Library Assistant through version 3.42 allows authenticated users with low privileges to retrieve embedded confidential data from responses sent by the plugin. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), requires a network-reachable request with no user interaction, and no public exploit was identified at time of analysis.
Cross-site request forgery in the WordPress plugin Media Library Assistant through version 3.42 lets an attacker induce a logged-in site user to submit a forged request in that user's existing session, producing low-integrity changes with no confidentiality or availability impact. This is a moderate-severity, low-priority issue rather than an urgent one: the attacker needs no account or privileges of their own but cannot succeed without a victim authenticated to WordPress who is tricked into visiting attacker-controlled content. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Stored cross-site scripting in the WordPress Media Library Assistant plugin (all versions through 3.41) allows an authenticated attacker with low-level privileges to plant persistent JavaScript that runs in the browser of a higher-privileged user who later views the affected page. Rated medium severity (CVSS 6.5), exploitation is gated by two prerequisites: a valid low-privilege WordPress account able to submit input into a Media Library Assistant field (PR:L) and a victim - typically an administrator or editor - who subsequently loads the page where the payload renders (UI:R), so sites that restrict account registration or avoid granting untrusted users content-entry roles are materially less exposed. No confirmed active exploitation (CISA KEV listing absent) and no public exploit code identified at time of analysis; the flaw is reported through Patchstack.
Cross-site scripting in the Media Library Assistant WordPress plugin (versions up to and including 3.39) allows a subscriber-level authenticated user to inject malicious scripts into the media library that execute in the browser session of a higher-privileged user, such as an administrator, who subsequently views the affected content. The scope change indicated by the CVSS vector (S:C) means successful exploitation crosses from the plugin context into the victim's browser, enabling session hijacking or privilege escalation within the WordPress installation. No public exploit code or active exploitation has been identified at time of analysis.
Blind SQL injection in the WordPress plugin Media Library Assistant through version 3.42 allows an authenticated low-privileged user to read sensitive data from the site database; the assessed impact is confidentiality-only. The issue is network-reachable with no user interaction required, but exploitation is gated by a valid account (PR:L) and the specific injectable endpoint or parameter is not named in the available sources. No public exploit code has been identified at time of analysis, and the issue carries a this_week priority rather than an emergency designation.
Stored cross-site scripting in the WordPress plugin Media Library Assistant (versions through 3.41) allows an attacker to persist a crafted script payload into media item metadata or attachment fields that the plugin later renders in the admin interface, where it executes in the browser context of an administrator or editor who loads the affected page. Exploitation is not fully self-contained: it requires user interaction (the victim must view the poisoned page) and, consistent with our assessed vector (PR:L rather than the CVE record's PR:N), realistically requires the attacker to hold some content-submission capability on the target site in order to store the payload. Impact is limited to low confidentiality, integrity, and availability within the victim's browser session, and no public exploit or confirmed active exploitation was identified at time of analysis.
SQL injection in the WordPress plugin Media Library Assistant (version 3.41 and earlier) allows an authenticated Contributor-level account to inject arbitrary SQL into the plugin's media/attachment query handling, reading database content such as user password hashes, private or draft posts, and stored configuration secrets. The issue is remotely exploitable with low complexity and no user interaction, and the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) yields a base score of 8.5 (High), reflecting confidentiality-only impact plus a scope change that lets the injection reach tables outside the plugin itself. There is no public exploit identified at time of analysis and no CISA KEV entry, so the practical barrier to abuse is obtaining a Contributor account - realistic on sites with open registration, multi-author blogs, or guest-post/membership setups, but not on locked-down single-admin installs.
Arbitrary file upload in the Media Library Assistant WordPress plugin (versions 3.39 and earlier) lets an authenticated user with Author-level access upload files of dangerous types, typically leading to remote code execution and full site compromise. The flaw was reported by Patchstack and is tracked as CWE-434; no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV. The CVSS 9.1 rating reflects the high impact and scope change, though the practical barrier is that an attacker must already hold an Author account.
Unauthenticated Cross-Site Scripting (XSS) in the Media Library Assistant WordPress plugin affects all versions up to and including 3.38, allowing remote attackers without any authentication to inject malicious scripts into pages viewed by victims. The scope change indicated by the CVSS vector (S:C) suggests the injected script executes in a security context beyond the plugin itself, potentially enabling session hijacking, credential theft, or malicious redirects against authenticated WordPress users including administrators. No public exploit code or active exploitation has been confirmed at time of analysis, but the unauthenticated nature and low attack complexity elevate practical risk on exposed WordPress installations.
Reflected cross-site scripting in the Media Library Assistant WordPress plugin (versions up to and including 3.35) allows unauthenticated remote attackers to inject script that executes in a victim's browser after a user-interaction event (clicking a crafted link). Per Patchstack, the issue affects David Lingren's plugin and currently has no public exploit identified at time of analysis, but the CVSS 7.1 (scope-changed) reflects that successful execution can pivot into authenticated admin contexts.
Blind SQL injection in Media Library Assistant through version 3.32 allows authenticated attackers to execute arbitrary SQL queries over the network, potentially leading to unauthorized data access and service disruption. The vulnerability requires valid user credentials but no user interaction, making it exploitable by internal or compromised accounts with minimal effort. No patch is currently available for affected installations.
DOM-based cross-site scripting in the Media Library Assistant WordPress plugin, affecting versions through 3.42, lets an authenticated low-privilege user plant script that runs in a victim's browser once that victim interacts with the attacker-influenced content. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, score 6.5) shows this is not unauthenticated against a default install: it needs a pre-existing WordPress account plus victim interaction, and the scope change means the injected script can act beyond the plugin's own origin context. No public exploit was identified at time of analysis and there is no KEV entry; the priority label is this_month.
Sensitive information disclosure in the WordPress plugin Media Library Assistant through version 3.42 allows authenticated users with low privileges to retrieve embedded confidential data from responses sent by the plugin. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), requires a network-reachable request with no user interaction, and no public exploit was identified at time of analysis.
Cross-site request forgery in the WordPress plugin Media Library Assistant through version 3.42 lets an attacker induce a logged-in site user to submit a forged request in that user's existing session, producing low-integrity changes with no confidentiality or availability impact. This is a moderate-severity, low-priority issue rather than an urgent one: the attacker needs no account or privileges of their own but cannot succeed without a victim authenticated to WordPress who is tricked into visiting attacker-controlled content. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Stored cross-site scripting in the WordPress Media Library Assistant plugin (all versions through 3.41) allows an authenticated attacker with low-level privileges to plant persistent JavaScript that runs in the browser of a higher-privileged user who later views the affected page. Rated medium severity (CVSS 6.5), exploitation is gated by two prerequisites: a valid low-privilege WordPress account able to submit input into a Media Library Assistant field (PR:L) and a victim - typically an administrator or editor - who subsequently loads the page where the payload renders (UI:R), so sites that restrict account registration or avoid granting untrusted users content-entry roles are materially less exposed. No confirmed active exploitation (CISA KEV listing absent) and no public exploit code identified at time of analysis; the flaw is reported through Patchstack.
Cross-site scripting in the Media Library Assistant WordPress plugin (versions up to and including 3.39) allows a subscriber-level authenticated user to inject malicious scripts into the media library that execute in the browser session of a higher-privileged user, such as an administrator, who subsequently views the affected content. The scope change indicated by the CVSS vector (S:C) means successful exploitation crosses from the plugin context into the victim's browser, enabling session hijacking or privilege escalation within the WordPress installation. No public exploit code or active exploitation has been identified at time of analysis.