Skip to content

Dglingren Media Library Assistant vulnerabilities

david lingren media library assistantMedia Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination LinksCVE-2026-1038754.7 MediumOctober 29, 2026
david lingren media library assistantMedia Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/ImportCVE-2026-66426.4 MediumSeptember 11, 2026
david lingren media library assistantMedia Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes ParameterCVE-2026-66406.4 MediumSeptember 11, 2026
david lingren media library assistantMedia Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode ParameterCVE-2026-66416.4 MediumSeptember 11, 2026
david lingren media library assistantMedia Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action FormCVE-2026-60758.1 HighMay 29, 2026
david lingren media library assistantMedia Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy ModificationCVE-2026-30724.3 MediumMarch 5, 2026
david lingren media library assistantMedia Library Assistant <= 3.29 - Unauthenticated Limited File ReadCVE-2025-117385.3 MediumOctober 18, 2025
david lingren media library assistantMedia Library Assistant <= 3.27 - Authenticated (Author+) Limited File DeletionCVE-2025-83574.3 MediumAugust 19, 2025
david lingren media library assistantMedia Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list ShortcodesCVE-2025-70356.4 MediumJuly 16, 2025
david lingren media library assistantMedia Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action ParametersCVE-2024-119746.1 MediumJanuary 4, 2025
david lingren media library assistantMedia Library Assistant <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX ActionCVE-2024-68238.8 HighAugust 13, 2024
david lingren media library assistantMedia Library Assistant <= 3.17 - Reflected Cross-Site ScriptingCVE-2024-55446.1 MediumJuly 2, 2024
david lingren media library assistantMedia Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order ParameterCVE-2024-56058.8 HighJune 20, 2024
david lingren media library assistantMedia Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via ShortcodeCVE-2024-35188.8 HighMay 21, 2024
david lingren media library assistantMedia Library Assistant <= 3.15 - Reflected Cross-Site Scripting via langCVE-2024-35196.1 MediumMay 21, 2024
david lingren media library assistantMedia Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via ShortcodeCVE-2024-28716.4 MediumApril 9, 2024
david lingren media library assistantMedia Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery ShortcodeCVE-2024-24756.4 MediumMarch 29, 2024
david lingren media library assistantMedia Library Assistant <= 3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeCVE-2023-47166.4 MediumSeptember 22, 2023
david lingren media library assistantMedia Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code ExecutionCVE-2023-4634Public exploitEPSS 85.6%9.8 CriticalSeptember 6, 2023