Login Request a demo
ML
Product
Media Library Folders
by maxfoundry · last CVE Feb 14, 2026
8
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Vulnerabilities8In the news0Timeline
Severity mix
Critical 0High 2Medium 6Low 0
Severity
All severities8Critical0High2Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Media Library Folders to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-30486
8.8
1%
Mar 29
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Max Foundry Media Library Folders.This issue affects Media Library Folders:…
Affected: before 8.1.8
CVE-2022-41634
8.8
0%
Nov 18
Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress
Affected: before 7.1.2
CVE-2024-7857
6.5
0%
Aug 29
The Media Library Folders plugin for WordPress is vulnerable to second order SQL Injection via the 'sort_type' parameter of the 'mlf_change_sort_type' AJAX action in all versions…
Affected: before 8.2.3
CVE-2024-31287
6.5
1%
Apr 10
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Max Foundry Media Library Folders.This issue affects Media Library Folders: from…
Affected: before 8.1.9
CVE-2024-7858
6.3
0%
Aug 30
The Media Library Folders plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several AJAX functions in the media-library-plus.php file…
Affected: before 8.2.4
CVE-2024-3615
6.1
0%
Apr 19
The Media Library Folders plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 8.2.0 due to…
Affected: before 8.1.8
CVE-2026-2312
4.3
0%
Feb 14
Media Library Folders <= 8.3.6 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Attachment Deletion and Rename
Affected: through 8.3.6
CVE-2025-0935
4.3
0%
Feb 15
The Media Library Folders plugin for WordPress is vulnerable to unauthorized plugin settings change due to a missing capability check on several AJAX actions in all versions up…
Affected: before 8.3.1
Showing 8