EN ES
Start free
Menu

Media Library Assistant: known security problems

49 known security problems reported for this WordPress plugin, with the affected versions, the fix and what to do.

Updated

In short

There are 49 known security problems on this page. Each one has a fixed version. Updating to version 3.43 or newer covers every fixed problem listed here.

Based on public reports. Check the plugin’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.42)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.42
Fixed in
3.43
What to do
If your site has an affected version, update Media Library Assistant to version 3.43 or newer.
Official ID
CVE-2026-103875
Report title
Media Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (before 3.42)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.42
Fixed in
3.42
What to do
If your site has an affected version, update Media Library Assistant to version 3.42 or newer.
Official ID
CVE-2026-113486
Report title
Media Library Assistant < 3.42 - Cross-Site Request Forgery
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.42
Fixed in
3.43
What to do
If your site has an affected version, update Media Library Assistant to version 3.43 or newer.
Official ID
CVE-2026-115594
Report title
Media Library Assistant <= 3.42 - Authenticated (Contributor+) Information Exposure
First reported
Sources
This week

Someone with an author account on your site could read or change the data in your site’s database (up to and including 3.42)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.42
Fixed in
3.43
What to do
If your site has an affected version, update Media Library Assistant to version 3.43 or newer.
Official ID
CVE-2026-115948
Report title
Media Library Assistant <= 3.42 - Authenticated (Author+) SQL Injection
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 3.42)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.42
Fixed in
3.43
What to do
If your site has an affected version, update Media Library Assistant to version 3.43 or newer.
Official ID
CVE-2026-97295
Report title
Media Library Assistant <= 3.42 - Cross-Site Request Forgery
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (before 3.42) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.42
Fixed in
3.42
What to do
If your site has an affected version, update Media Library Assistant to version 3.42 or newer.
Official ID
CVE-2026-113485
Report title
Media Library Assistant < 3.42 - Cross-Site Request Forgery
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.41)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.41
Fixed in
3.42
What to do
If your site has an affected version, update Media Library Assistant to version 3.42 or newer.
Official ID
CVE-2026-97294
Report title
Media Library Assistant <= 3.41 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 3.41)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.41
Fixed in
3.42
What to do
If your site has an affected version, update Media Library Assistant to version 3.42 or newer.
Official ID
CVE-2026-95609
Report title
Media Library Assistant <= 3.41 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could read or change the data in your site’s database (up to and including 3.41)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.41
Fixed in
3.42
What to do
If your site has an affected version, update Media Library Assistant to version 3.42 or newer.
Official ID
CVE-2026-97293
Report title
Media Library Assistant <= 3.41 - Authenticated (Contributor+) SQL Injection
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.35)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.35
Fixed in
3.36
What to do
If your site has an affected version, update Media Library Assistant to version 3.36 or newer.
Official ID
CVE-2026-6641
Report title
Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter
First reported
Sources
This week

Someone with an author account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.35)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.35
Fixed in
3.36
What to do
If your site has an affected version, update Media Library Assistant to version 3.36 or newer.
Official ID
CVE-2026-6642
Report title
Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.35) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.35
Fixed in
3.36
What to do
If your site has an affected version, update Media Library Assistant to version 3.36 or newer.
Official ID
CVE-2026-6640
Report title
Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter
First reported
Sources
This week

Someone with an author account on your site could read or change the data in your site’s database (before 3.40)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.40
Fixed in
3.40
What to do
If your site has an affected version, update Media Library Assistant to version 3.40 or newer.
Official ID
CVE-2026-16959
Report title
Media Library Assistant < 3.40 - Authenticated (Author+) SQL Injection
First reported
Sources
This week

Someone with an author account on your site could run their own code on your site and take it over (up to and including 3.39)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.39
Fixed in
3.40
What to do
If your site has an affected version, update Media Library Assistant to version 3.40 or newer.
Official ID
CVE-2026-66600
Report title
Media Library Assistant <= 3.39 - Authenticated (Author+) Arbitrary File Upload
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.39
Fixed in
3.40
What to do
If your site has an affected version, update Media Library Assistant to version 3.40 or newer.
Official ID
CVE-2026-66601
Report title
Media Library Assistant <= 3.39 - Authenticated (Subscriber+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.39)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.39
Fixed in
3.40
What to do
If your site has an affected version, update Media Library Assistant to version 3.40 or newer.
Official ID
CVE-2026-66591
Report title
Media Library Assistant <= 3.39 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 3.38)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.38
Fixed in
3.39
What to do
If your site has an affected version, update Media Library Assistant to version 3.39 or newer.
Official ID
CVE-2026-61963
Report title
Media Library Assistant <= 3.38 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could read or change the data in your site’s database (up to and including 3.35)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.35
Fixed in
3.36
What to do
If your site has an affected version, update Media Library Assistant to version 3.36 or newer.
Official ID
CVE-2026-56012
Report title
Media Library Assistant <= 3.35 - Authenticated (Contributor+) SQL Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.35)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.35
Fixed in
3.36
What to do
If your site has an affected version, update Media Library Assistant to version 3.36 or newer.
Official ID
CVE-2026-54198
Report title
Media Library Assistant <= 3.35 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 3.35)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.35
Fixed in
3.36
What to do
If your site has an affected version, update Media Library Assistant to version 3.36 or newer.
Official ID
CVE-2026-6075
Report title
Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form
First reported
Sources
This week

Someone with a contributor account on your site could read or change the data in your site’s database (up to and including 3.34)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.34
Fixed in
3.35
What to do
If your site has an affected version, update Media Library Assistant to version 3.35 or newer.
Official ID
CVE-2026-34885
Report title
Media Library Assistant <= 3.34 - Authenticated (Contributor+) SQL Injection
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.34)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.34
Fixed in
3.35
What to do
If your site has an affected version, update Media Library Assistant to version 3.35 or newer.
Official ID
CVE-2026-34897
Report title
Media Library Assistant <= 3.34 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.33
Fixed in
3.34
What to do
If your site has an affected version, update Media Library Assistant to version 3.34 or newer.
Official ID
CVE-2026-3072
Report title
Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification
First reported
Sources
This week

Someone with a contributor account on your site could read or change the data in your site’s database (up to and including 3.32)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.32
Fixed in
3.33
What to do
If your site has an affected version, update Media Library Assistant to version 3.33 or newer.
Official ID
CVE-2026-32399
Report title
Media LIbrary Assistant <= 3.32 - Authenticated (Contributor+) SQL Injection
First reported
Sources
This week

A stranger could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.29
Fixed in
3.30
What to do
If your site has an affected version, update Media Library Assistant to version 3.30 or newer.
Official ID
CVE-2025-11738
Report title
Media Library Assistant <= 3.29 - Unauthenticated Limited File Read
First reported
Sources
This week

Someone could do things on your site they should not be allowed to

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.29
Fixed in
3.30
What to do
If your site has an affected version, update Media Library Assistant to version 3.30 or newer.
Official ID
CVE-2025-63065
Report title
Media Library Assistant <= 3.29 - Missing Authorization
First reported
Sources
This week

Someone with an author account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.28)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.28
Fixed in
3.29
What to do
If your site has an affected version, update Media Library Assistant to version 3.29 or newer.
Official ID
CVE-2025-59590
Report title
Media Library Assistant <= 3.28 - Authenticated (Author+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with an author account on your site could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.27
Fixed in
3.28
What to do
If your site has an affected version, update Media Library Assistant to version 3.28 or newer.
Official ID
CVE-2025-8357
Report title
Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.26)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.26
Fixed in
3.27
What to do
If your site has an affected version, update Media Library Assistant to version 3.27 or newer.
Official ID
CVE-2025-7035
Report title
Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes
First reported
Sources
This week

Someone who already has an admin account could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.24
Fixed in
3.25
What to do
If your site has an affected version, update Media Library Assistant to version 3.25 or newer.
Official ID
CVE-2025-31627
Report title
Media Library Assistant <= 3.24 - Authenticated (Administrator+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.23)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.23
Fixed in
3.24
What to do
If your site has an affected version, update Media Library Assistant to version 3.24 or newer.
Official ID
CVE-2024-11974
Report title
Media Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters
First reported
Sources
This week

Someone who already has an admin account could run their own code on your site and take it over

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.19
Fixed in
3.20
What to do
If your site has an affected version, update Media Library Assistant to version 3.20 or newer.
Official ID
CVE-2024-51661
Report title
Media Library Assistant <= 3.19 - Authenticated (Administrator+) Remote Code Execution
First reported
Sources
This week

Someone with an author account on your site could run their own code on your site and take it over (up to and including 3.18)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.18
Fixed in
3.19
What to do
If your site has an affected version, update Media Library Assistant to version 3.19 or newer.
Official ID
CVE-2024-6823
Report title
Media Library Assistant <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.17)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.17
Fixed in
3.18
What to do
If your site has an affected version, update Media Library Assistant to version 3.18 or newer.
Official ID
CVE-2024-5544
Report title
Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could read or change the data in your site’s database (up to and including 3.16)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.16
Fixed in
3.17
What to do
If your site has an affected version, update Media Library Assistant to version 3.17 or newer.
Official ID
CVE-2024-5605
Report title
Media Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameter
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.15)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.15
Fixed in
3.16
What to do
If your site has an affected version, update Media Library Assistant to version 3.16 or newer.
Official ID
CVE-2024-3519
Report title
Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang
First reported
Sources
This week

Someone with a contributor account on your site could read or change the data in your site’s database (up to and including 3.15)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.15
Fixed in
3.16
What to do
If your site has an affected version, update Media Library Assistant to version 3.16 or newer.
Official ID
CVE-2024-3518
Report title
Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.13)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.13
Fixed in
3.14
What to do
If your site has an affected version, update Media Library Assistant to version 3.14 or newer.
Official ID
CVE-2024-2475
Report title
Media Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode
First reported
Sources
This week

Someone with a contributor account on your site could read or change the data in your site’s database (up to and including 3.13)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.13
Fixed in
3.14
What to do
If your site has an affected version, update Media Library Assistant to version 3.14 or newer.
Official ID
CVE-2024-2871
Report title
Media Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcode
First reported
Sources
This week

Someone with an author account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.11)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.11
Fixed in
3.12
What to do
If your site has an affected version, update Media Library Assistant to version 3.12 or newer.
Official ID
CVE-2023-24385
Report title
Media Library Assistant <= 3.11 - Authenticated (Author+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.10)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.10
Fixed in
3.11
What to do
If your site has an affected version, update Media Library Assistant to version 3.11 or newer.
Official ID
CVE-2023-4716
Report title
Media Library Assistant <= 3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
First reported
Sources
This week

A stranger could run their own code on your site and take it over

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.09
Fixed in
3.10
What to do
If your site has an affected version, update Media Library Assistant to version 3.10 or newer.
Official ID
CVE-2023-4634
Report title
Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.0.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.0.7
Fixed in
3.0.8
What to do
If your site has an affected version, update Media Library Assistant to version 3.0.8 or newer.
Official ID
CVE-2023-34010
Report title
Media Library Assistant <= 3.07 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone who already has an admin account could read or change the data in your site’s database

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.05
Fixed in
3.06
What to do
If your site has an affected version, update Media Library Assistant to version 3.06 or newer.
Official ID
CVE-2023-0279
Report title
Media Library Assistant <= 3.05 - Authenticated (Administrator+) SQL Injection
First reported
Sources
This week

Someone could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.00
Fixed in
3.01
What to do
If your site has an affected version, update Media Library Assistant to version 3.01 or newer.
Official ID
CVE-2022-41618
Report title
Media Library Assistant <= 3.00 - Information Disclosure
First reported
Sources
This week

Someone could run their own code on your site and take it over

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.81
Fixed in
2.82
What to do
If your site has an affected version, update Media Library Assistant to version 2.82 or newer.
Official ID
CVE-2020-11928
Report title
Media Library Assistant <= 2.81 - Remote Code Execution via tax_query, meta_query, date_query Parameters
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.82)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.82
Fixed in
2.82
What to do
If your site has an affected version, update Media Library Assistant to version 2.82 or newer.
Official ID
CVE-2020-11731
Report title
Media Library Assistant <= 2.81 - Authenticated Cross-Site Scripting
First reported
Sources
This week

Someone could read or delete private files on your server

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.81
Fixed in
2.82
What to do
If your site has an affected version, update Media Library Assistant to version 2.82 or newer.
Official ID
CVE-2020-11732
Report title
Media Library Assistant <= 2.81 - Local File Inclusion
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.7.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.7.4
Fixed in
2.74
What to do
If your site has an affected version, update Media Library Assistant to version 2.74 or newer.
Official ID
CVE-2018-20982
Report title
Media Library Assistant <= 2.73 - Cross-Site Scripting
First reported
Sources

Where this comes from

We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)