Extension WordPress
Vulnérabilités Media Library Assistant
Cette page rassemble les failles publiées pour Media Library Assistant, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Media Library Assistant
32 fiches
Media Library Assistant <= 3.35 – Authenticated (Contributor+) SQL Injection
The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.35 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.…
*-3.35
3.36
18/06/2026
Media Library Assistant <= 3.35 – Reflected Cross-Site Scripting
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary…
*-3.35
3.36
15/06/2026
Media Library Assistant <= 3.35 – Cross-Site Request Forgery via Bulk Action Form
The Media Library Assistant plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.35 This is due to missing nonce verification on the bulk action handlers in the settings tab handlers. This…
*-3.35
3.36
28/05/2026
Media Library Assistant <= 3.34 – Authenticated (Contributor+) SQL Injection
The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.34 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.…
*-3.34
3.35
06/04/2026
Media Library Assistant <= 3.34 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.34 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access…
*-3.34
3.35
06/04/2026
Media Library Assistant <= 3.33 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification
The Media Library Assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mla_update_compat_fields_action() function in all versions up to, and including, 3.33. This makes it possible for authenticated…
*-3.33
3.34
04/03/2026
Media LIbrary Assistant <= 3.32 – Authenticated (Contributor+) SQL Injection
The Media LIbrary Assistant plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.32 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.…
*-3.32
3.33
20/02/2026
Media Library Assistant <= 3.29 – Unauthenticated Limited File Read
The Media Library Assistant plugin for WordPress is vulnerable to limited file reading in all versions up to, and including, 3.29 via the mla-stream-image.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary…
*-3.29
3.30
17/10/2025
Media Library Assistant <= 3.29 – Missing Authorization
The Media Library Assistant plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.29. This makes it possible for unauthenticated attackers to perform an…
*-3.29
3.30
09/10/2025
Media Library Assistant <= 3.28 – Authenticated (Author+) Stored Cross-Site Scripting
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access…
*-3.28
3.29
22/09/2025
Media Library Assistant <= 3.27 – Authenticated (Author+) Limited File Deletion
The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file deletion in the /wp-content/uploads directory due to insufficient file path validation and user capability checking in the _process_mla_download_file function in all versions up to, and including,…
*-3.27
3.28
18/08/2025
Media Library Assistant <= 3.26 – Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mla_tag_cloud and mla_term_list shortcodes in all versions up to, and including, 3.26 due to insufficient input sanitization and output escaping on user…
*-3.26
3.27
15/07/2025
Media Library Assistant <= 3.24 – Authenticated (Administrator+) Stored Cross-Site Scripting
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access…
*-3.24
3.25
31/03/2025
Media Library Assistant <= 3.23 – Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘smc_settings_tab', 'unattachfixit-action', and 'woofixit-action’ parameters in all versions up to, and including, 3.23 due to insufficient input sanitization and output escaping. This makes…
*-3.23
3.24
03/01/2025
Media Library Assistant <= 3.19 – Authenticated (Administrator+) Remote Code Execution
The Media Library Assistant plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.19. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the…
*-3.19
3.20
01/11/2024
Media Library Assistant <= 3.18 – Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action
The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation involving the mla-inline-edit-upload-scripts AJAX action in all versions up to, and including, 3.18. This makes it possible for authenticated…
*-3.18
3.19
12/08/2024
Media Library Assistant <= 3.17 – Reflected Cross-Site Scripting
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order parameter in all versions up to, and including, 3.17 due to insufficient input sanitization and output escaping. This makes it possible for…
*-3.17
3.18
01/07/2024
Media Library Assistant <= 3.16 – Authenticated (Contributor+) SQL Injection via order Parameter
The Media Library Assistant plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter within the mla_tag_cloud Shortcode in all versions up to, and including, 3.16 due to insufficient escaping on the user supplied parameter…
*-3.16
3.17
19/06/2024
Media Library Assistant <= 3.15 – Reflected Cross-Site Scripting via lang
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the lang parameter in all versions up to, and including, 3.15 due to insufficient input sanitization and output escaping. This makes it possible for…
*-3.15
3.16
21/05/2024
Media Library Assistant <= 3.15 – Authenticated (Contributor+) SQL Injection via Shortcode
The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and including, 3.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation…
*-3.15
3.16
21/05/2024
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.