Media Library Assistant
Monthly
Stored cross-site scripting in the WordPress plugin Media Library Assistant (versions through 3.41) allows an attacker to persist a crafted script payload into media item metadata or attachment fields that the plugin later renders in the admin interface, where it executes in the browser context of an administrator or editor who loads the affected page. Exploitation is not fully self-contained: it requires user interaction (the victim must view the poisoned page) and, consistent with our assessed vector (PR:L rather than the CVE record's PR:N), realistically requires the attacker to hold some content-submission capability on the target site in order to store the payload. Impact is limited to low confidentiality, integrity, and availability within the victim's browser session, and no public exploit or confirmed active exploitation was identified at time of analysis.
SQL injection in the WordPress plugin Media Library Assistant (version 3.41 and earlier) allows an authenticated Contributor-level account to inject arbitrary SQL into the plugin's media/attachment query handling, reading database content such as user password hashes, private or draft posts, and stored configuration secrets. The issue is remotely exploitable with low complexity and no user interaction, and the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) yields a base score of 8.5 (High), reflecting confidentiality-only impact plus a scope change that lets the injection reach tables outside the plugin itself. There is no public exploit identified at time of analysis and no CISA KEV entry, so the practical barrier to abuse is obtaining a Contributor account - realistic on sites with open registration, multi-author blogs, or guest-post/membership setups, but not on locked-down single-admin installs.
Arbitrary file upload in the Media Library Assistant WordPress plugin (versions 3.39 and earlier) lets an authenticated user with Author-level access upload files of dangerous types, typically leading to remote code execution and full site compromise. The flaw was reported by Patchstack and is tracked as CWE-434; no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV. The CVSS 9.1 rating reflects the high impact and scope change, though the practical barrier is that an attacker must already hold an Author account.
Unauthenticated Cross-Site Scripting (XSS) in the Media Library Assistant WordPress plugin affects all versions up to and including 3.38, allowing remote attackers without any authentication to inject malicious scripts into pages viewed by victims. The scope change indicated by the CVSS vector (S:C) suggests the injected script executes in a security context beyond the plugin itself, potentially enabling session hijacking, credential theft, or malicious redirects against authenticated WordPress users including administrators. No public exploit code or active exploitation has been confirmed at time of analysis, but the unauthenticated nature and low attack complexity elevate practical risk on exposed WordPress installations.
Reflected cross-site scripting in the Media Library Assistant WordPress plugin (versions up to and including 3.35) allows unauthenticated remote attackers to inject script that executes in a victim's browser after a user-interaction event (clicking a crafted link). Per Patchstack, the issue affects David Lingren's plugin and currently has no public exploit identified at time of analysis, but the CVSS 7.1 (scope-changed) reflects that successful execution can pivot into authenticated admin contexts.
Cross-Site Request Forgery in the Media Library Assistant WordPress plugin versions 3.35 and earlier allows remote attackers to coerce authenticated administrators into executing bulk delete, edit, or purge actions against plugin settings and attachment metadata. The flaw stems from missing nonce checks on bulk action handlers across multiple settings tabs and was reported by Wordfence. There is no public exploit identified at time of analysis and no CISA KEV listing, but the high CVSS of 8.1 reflects significant integrity and availability impact if a logged-in admin is lured to a malicious page.
Blind SQL injection in Media Library Assistant through version 3.32 allows authenticated attackers to execute arbitrary SQL queries over the network, potentially leading to unauthorized data access and service disruption. The vulnerability requires valid user credentials but no user interaction, making it exploitable by internal or compromised accounts with minimal effort. No patch is currently available for affected installations.
Stored cross-site scripting in the WordPress Media Library Assistant plugin (all versions through 3.41) allows an authenticated attacker with low-level privileges to plant persistent JavaScript that runs in the browser of a higher-privileged user who later views the affected page. Rated medium severity (CVSS 6.5), exploitation is gated by two prerequisites: a valid low-privilege WordPress account able to submit input into a Media Library Assistant field (PR:L) and a victim - typically an administrator or editor - who subsequently loads the page where the payload renders (UI:R), so sites that restrict account registration or avoid granting untrusted users content-entry roles are materially less exposed. No confirmed active exploitation (CISA KEV listing absent) and no public exploit code identified at time of analysis; the flaw is reported through Patchstack.
Stored Cross-Site Scripting in the Media Library Assistant WordPress plugin (versions ≤3.35) allows authenticated contributors to inject persistent malicious scripts via the unsanitized `mla_link_attributes` shortcode parameter. Any user who subsequently loads the injected page executes the attacker-controlled script in their browser context, enabling session hijacking, credential theft, or privilege escalation to administrator. A patch was committed in changeset 3512155 and no public exploit has been identified at time of analysis.
Stored Cross-Site Scripting in Media Library Assistant (WordPress plugin, ≤3.35) allows authenticated attackers with Author-level access to poison bulk edit preset configurations and execute arbitrary JavaScript in the context of an administrator's browser session. The flaw bypasses the `wp_kses()` tag-filtering safeguard because the payload operates at the HTML attribute level - injecting closing quotes and inline event handlers - exploiting the absence of `esc_attr()` escaping when preset field values are rendered into `<input value="...">` attributes via simple string replacement in `mla_generate_bulk_edit_form_fieldsets()` and the `mla-bulk-edit-fieldsets.tpl` template. No public exploit code and no CISA KEV listing are present in the available data; exploitation requires social engineering an administrator into importing a crafted preset file.
Stored Cross-Site Scripting in the Media Library Assistant WordPress plugin (versions ≤3.35) allows authenticated contributors to plant persistent JavaScript payloads that execute in any visitor's browser. The injection point is the mla_link_href parameter of the [mla_gallery] shortcode when mla_output is set to 'paginate_links': the _paginate_links() function processes the value through mla_process_shortcode_parameter() and _replace_query_parameter() but writes the result directly into href attributes without invoking WordPress's esc_url() sanitizer, leaving the output unsanitized. No public exploit has been identified at time of analysis, and a fix has been committed to the plugin's SVN trunk (changeset 3512155), though the exact released patch version is not independently confirmed from the available references.
SQL injection in the Media Library Assistant WordPress plugin before version 3.40 allows authenticated users with the Author role to read sensitive database contents by injecting arbitrary SQL via an unvalidated search parameter in a media-library query handler. The scope-changed CVSS vector (S:C) reflects that exploitation can reach data beyond the plugin's immediate database scope, and a publicly available proof-of-concept exists per WPScan's disclosure. No public exploit identified at time of analysis for active exploitation, though the POC lowers the bar for abuse against any WordPress installation running the unpatched plugin.
Cross-site scripting in the Media Library Assistant WordPress plugin (versions up to and including 3.39) allows a subscriber-level authenticated user to inject malicious scripts into the media library that execute in the browser session of a higher-privileged user, such as an administrator, who subsequently views the affected content. The scope change indicated by the CVSS vector (S:C) means successful exploitation crosses from the plugin context into the victim's browser, enabling session hijacking or privilege escalation within the WordPress installation. No public exploit code or active exploitation has been identified at time of analysis.
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘smc_settings_tab', 'unattachfixit-action', and 'woofixit-action’ parameters in all versions. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Command Injection.19. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation involving the mla-inline-edit-upload-scripts AJAX action in all versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order parameter in all versions up to, and including, 3.17 due to insufficient input. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Media Library Assistant plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter within the mla_tag_cloud Shortcode in all versions up to, and including, 3.16 due. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the lang parameter in all versions up to, and including, 3.15 due to insufficient input. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and including, 3.15 due to insufficient escaping on the user. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and including, 3.13 due to insufficient escaping on the user. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.13 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up to, and including, 3.10 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 92.1%.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Media Library Assistant WordPress plugin before 3.06 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin <= 3.00 on WordPress. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_query parameter in mla_gallery via an admin. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_gallery link=download. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Media Library Assistant plugin before 2.82 for Wordpress suffers from multiple XSS vulnerabilities in all Settings/Media Library Assistant tabs, which allow remote authenticated users to execute. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting in the WordPress plugin Media Library Assistant (versions through 3.41) allows an attacker to persist a crafted script payload into media item metadata or attachment fields that the plugin later renders in the admin interface, where it executes in the browser context of an administrator or editor who loads the affected page. Exploitation is not fully self-contained: it requires user interaction (the victim must view the poisoned page) and, consistent with our assessed vector (PR:L rather than the CVE record's PR:N), realistically requires the attacker to hold some content-submission capability on the target site in order to store the payload. Impact is limited to low confidentiality, integrity, and availability within the victim's browser session, and no public exploit or confirmed active exploitation was identified at time of analysis.
SQL injection in the WordPress plugin Media Library Assistant (version 3.41 and earlier) allows an authenticated Contributor-level account to inject arbitrary SQL into the plugin's media/attachment query handling, reading database content such as user password hashes, private or draft posts, and stored configuration secrets. The issue is remotely exploitable with low complexity and no user interaction, and the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) yields a base score of 8.5 (High), reflecting confidentiality-only impact plus a scope change that lets the injection reach tables outside the plugin itself. There is no public exploit identified at time of analysis and no CISA KEV entry, so the practical barrier to abuse is obtaining a Contributor account - realistic on sites with open registration, multi-author blogs, or guest-post/membership setups, but not on locked-down single-admin installs.
Arbitrary file upload in the Media Library Assistant WordPress plugin (versions 3.39 and earlier) lets an authenticated user with Author-level access upload files of dangerous types, typically leading to remote code execution and full site compromise. The flaw was reported by Patchstack and is tracked as CWE-434; no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV. The CVSS 9.1 rating reflects the high impact and scope change, though the practical barrier is that an attacker must already hold an Author account.
Unauthenticated Cross-Site Scripting (XSS) in the Media Library Assistant WordPress plugin affects all versions up to and including 3.38, allowing remote attackers without any authentication to inject malicious scripts into pages viewed by victims. The scope change indicated by the CVSS vector (S:C) suggests the injected script executes in a security context beyond the plugin itself, potentially enabling session hijacking, credential theft, or malicious redirects against authenticated WordPress users including administrators. No public exploit code or active exploitation has been confirmed at time of analysis, but the unauthenticated nature and low attack complexity elevate practical risk on exposed WordPress installations.
Reflected cross-site scripting in the Media Library Assistant WordPress plugin (versions up to and including 3.35) allows unauthenticated remote attackers to inject script that executes in a victim's browser after a user-interaction event (clicking a crafted link). Per Patchstack, the issue affects David Lingren's plugin and currently has no public exploit identified at time of analysis, but the CVSS 7.1 (scope-changed) reflects that successful execution can pivot into authenticated admin contexts.
Cross-Site Request Forgery in the Media Library Assistant WordPress plugin versions 3.35 and earlier allows remote attackers to coerce authenticated administrators into executing bulk delete, edit, or purge actions against plugin settings and attachment metadata. The flaw stems from missing nonce checks on bulk action handlers across multiple settings tabs and was reported by Wordfence. There is no public exploit identified at time of analysis and no CISA KEV listing, but the high CVSS of 8.1 reflects significant integrity and availability impact if a logged-in admin is lured to a malicious page.
Blind SQL injection in Media Library Assistant through version 3.32 allows authenticated attackers to execute arbitrary SQL queries over the network, potentially leading to unauthorized data access and service disruption. The vulnerability requires valid user credentials but no user interaction, making it exploitable by internal or compromised accounts with minimal effort. No patch is currently available for affected installations.
Stored cross-site scripting in the WordPress Media Library Assistant plugin (all versions through 3.41) allows an authenticated attacker with low-level privileges to plant persistent JavaScript that runs in the browser of a higher-privileged user who later views the affected page. Rated medium severity (CVSS 6.5), exploitation is gated by two prerequisites: a valid low-privilege WordPress account able to submit input into a Media Library Assistant field (PR:L) and a victim - typically an administrator or editor - who subsequently loads the page where the payload renders (UI:R), so sites that restrict account registration or avoid granting untrusted users content-entry roles are materially less exposed. No confirmed active exploitation (CISA KEV listing absent) and no public exploit code identified at time of analysis; the flaw is reported through Patchstack.
Stored Cross-Site Scripting in the Media Library Assistant WordPress plugin (versions ≤3.35) allows authenticated contributors to inject persistent malicious scripts via the unsanitized `mla_link_attributes` shortcode parameter. Any user who subsequently loads the injected page executes the attacker-controlled script in their browser context, enabling session hijacking, credential theft, or privilege escalation to administrator. A patch was committed in changeset 3512155 and no public exploit has been identified at time of analysis.
Stored Cross-Site Scripting in Media Library Assistant (WordPress plugin, ≤3.35) allows authenticated attackers with Author-level access to poison bulk edit preset configurations and execute arbitrary JavaScript in the context of an administrator's browser session. The flaw bypasses the `wp_kses()` tag-filtering safeguard because the payload operates at the HTML attribute level - injecting closing quotes and inline event handlers - exploiting the absence of `esc_attr()` escaping when preset field values are rendered into `<input value="...">` attributes via simple string replacement in `mla_generate_bulk_edit_form_fieldsets()` and the `mla-bulk-edit-fieldsets.tpl` template. No public exploit code and no CISA KEV listing are present in the available data; exploitation requires social engineering an administrator into importing a crafted preset file.
Stored Cross-Site Scripting in the Media Library Assistant WordPress plugin (versions ≤3.35) allows authenticated contributors to plant persistent JavaScript payloads that execute in any visitor's browser. The injection point is the mla_link_href parameter of the [mla_gallery] shortcode when mla_output is set to 'paginate_links': the _paginate_links() function processes the value through mla_process_shortcode_parameter() and _replace_query_parameter() but writes the result directly into href attributes without invoking WordPress's esc_url() sanitizer, leaving the output unsanitized. No public exploit has been identified at time of analysis, and a fix has been committed to the plugin's SVN trunk (changeset 3512155), though the exact released patch version is not independently confirmed from the available references.
SQL injection in the Media Library Assistant WordPress plugin before version 3.40 allows authenticated users with the Author role to read sensitive database contents by injecting arbitrary SQL via an unvalidated search parameter in a media-library query handler. The scope-changed CVSS vector (S:C) reflects that exploitation can reach data beyond the plugin's immediate database scope, and a publicly available proof-of-concept exists per WPScan's disclosure. No public exploit identified at time of analysis for active exploitation, though the POC lowers the bar for abuse against any WordPress installation running the unpatched plugin.
Cross-site scripting in the Media Library Assistant WordPress plugin (versions up to and including 3.39) allows a subscriber-level authenticated user to inject malicious scripts into the media library that execute in the browser session of a higher-privileged user, such as an administrator, who subsequently views the affected content. The scope change indicated by the CVSS vector (S:C) means successful exploitation crosses from the plugin context into the victim's browser, enabling session hijacking or privilege escalation within the WordPress installation. No public exploit code or active exploitation has been identified at time of analysis.
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘smc_settings_tab', 'unattachfixit-action', and 'woofixit-action’ parameters in all versions. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Command Injection.19. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation involving the mla-inline-edit-upload-scripts AJAX action in all versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order parameter in all versions up to, and including, 3.17 due to insufficient input. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Media Library Assistant plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter within the mla_tag_cloud Shortcode in all versions up to, and including, 3.16 due. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the lang parameter in all versions up to, and including, 3.15 due to insufficient input. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and including, 3.15 due to insufficient escaping on the user. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and including, 3.13 due to insufficient escaping on the user. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.13 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up to, and including, 3.10 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 92.1%.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Media Library Assistant WordPress plugin before 3.06 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin <= 3.00 on WordPress. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_query parameter in mla_gallery via an admin. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_gallery link=download. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Media Library Assistant plugin before 2.82 for Wordpress suffers from multiple XSS vulnerabilities in all Settings/Media Library Assistant tabs, which allow remote authenticated users to execute. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.