Davidlingren Media_library_assistant
19 CVEs affecting Davidlingren Media_library_assistant. Latest disclosed: 2025-07-16. Critical: 3, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-4634 | Critical | 9.8 | 2023-09-06 | The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This i… |
CVE-2020-11928 | Critical | 9.8 | 2020-04-20 | In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_query parameter in mla_… |
CVE-2024-51661 | Critical | 9.1 | 2024-11-04 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in David Lingren Media LIbrary Assistant media-library… |
CVE-2024-6823 | High | 8.8 | 2024-08-13 | The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation involving the mla-inline-edit-uplo… |
CVE-2024-5605 | High | 8.8 | 2024-06-20 | The Media Library Assistant plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter within the mla_tag_cloud Shortcode in all… |
CVE-2024-3518 | High | 8.8 | 2024-05-22 | The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and including, 3.15 due to… |
CVE-2020-11732 | High | 7.5 | 2020-04-13 | The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_gallery link=download. |
CVE-2025-7035 | Medium | 6.4 | 2025-07-16 | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mla_tag_cloud and mla_term_list shortcodes in al… |
CVE-2024-2871 | Medium | 6.4 | 2024-04-09 | The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and including, 3.13 due to… |
CVE-2024-2475 | Medium | 6.4 | 2024-03-29 | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including… |
CVE-2023-4716 | Medium | 6.4 | 2023-09-22 | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up to, and including… |
CVE-2024-11974 | Medium | 6.1 | 2025-01-04 | The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘smc_settings_tab', 'unattachfixit-action', and 'woofi… |
CVE-2024-5544 | Medium | 6.1 | 2024-07-02 | The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order parameter in all versions up to, and including… |
CVE-2024-3519 | Medium | 6.1 | 2024-05-22 | The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the lang parameter in all versions up to, and including, 3… |
CVE-2020-11731 | Medium | 6.1 | 2020-04-13 | The Media Library Assistant plugin before 2.82 for Wordpress suffers from multiple XSS vulnerabilities in all Settings/Media Library Assistant tabs, which allo… |
CVE-2018-20982 | Medium | 6.1 | 2019-08-22 | The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens. |
CVE-2023-24385 | Medium | 5.9 | 2023-10-17 | Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in David Lingren Media Library Assistant plugin <= 3.11 versions. |
CVE-2023-34010 | Medium | 5.8 | 2023-08-05 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in submodule of David Lingren Media Library Assistant plugin <= 3.0.7 versions. |
CVE-2022-41618 | Low | 3.7 | 2022-11-18 | Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin <= 3.00 on WordPress. |