Media Library Assistant vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

ML

Product

Media Library Assistant

by dglingren · last CVE Oct 29, 2026

15

CVEs

0

On KEV

8.8

Max CVSS

1

New 30D

Vulnerabilities15 In the news0 Timeline

Severity mix

Critical 0High 3Medium 12Low 0

Severity

All severities15 Critical0 High3 Medium12 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Media Library Assistant to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2024-6823	8.8	1%	Aug 13	Media Library Assistant <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action Affected: through 3.18
CVE-2024-5605	8.8	1%	Jun 20	Media Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameter Affected: through 3.16
CVE-2026-6075	8.1	0%	May 29	Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form Affected: through 3.35
CVE-2024-3518	6.5	1%	May 21	Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode Affected: through 3.15
CVE-2026-6640	6.4	0%	Sep 11	Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter Affected: through 3.35
CVE-2026-6642	6.4	0%	Sep 11	Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import Affected: through 3.35
CVE-2026-6641	6.4	0%	Sep 11	Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter Affected: through 3.35
CVE-2024-11974	6.1	0%	Jan 4	Media Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters Affected: through 3.23
CVE-2024-5544	6.1	0%	Jul 2	Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting Affected: through 3.17
CVE-2024-3519	6.1	0%	May 21	Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang Affected: through 3.15
CVE-2025-7035	5.4	0%	Jul 16	Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes Affected: through 3.26
CVE-2025-11738	5.3	0%	Oct 18	Media Library Assistant <= 3.29 - Unauthenticated Limited File Read Affected: through 3.29
CVE-2026-103875 New	4.7	–	Oct 29	Media Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links Affected: through 3.42
CVE-2026-3072	4.3	0%	Mar 5	Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification Affected: through 3.33
CVE-2025-8357	4.3	0%	Aug 19	Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion Affected: through 3.27