WordPress plugin
Media Library Assistant security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 54 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High10
- Medium42
- Low0
All Media Library Assistant vulnerabilities
- Medium4.3Missing Authorization
≤3.43Update to 3.44
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
≤3.43Update to 3.44
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.43Update to 3.44
- Medium4.3Missing Authorization
≤3.43Update to 3.44
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.42Update to 3.43
- Medium4.7Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links
≤3.42Update to 3.43
- Medium4.3Cross-Site Request Forgery
<3.42Update to 3.42
- Medium4.3Authenticated (Contributor+) Information Exposure
≤3.42Update to 3.43
- Medium6.5Authenticated (Author+) SQL Injection
≤3.42Update to 3.43
- Medium4.3Cross-Site Request Forgery
≤3.42Update to 3.43
- Medium4.3Cross-Site Request Forgery
<3.42Update to 3.42
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.41Update to 3.42
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.41Update to 3.42
- Medium6.5Authenticated (Contributor+) SQL Injection
≤3.41Update to 3.42
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter
≤3.35Update to 3.36
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter
≤3.35Update to 3.36
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import
≤3.35Update to 3.36
- Medium6.5Authenticated (Author+) SQL Injection
<3.40Update to 3.40
- High8.8Authenticated (Author+) Arbitrary File Upload
≤3.39Update to 3.40
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤3.39Update to 3.40
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.39Update to 3.40
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.38Update to 3.39
- Medium6.5Authenticated (Contributor+) SQL Injection
≤3.35Update to 3.36
- Medium6.1Reflected Cross-Site Scripting
≤3.35Update to 3.36
- High8.1Cross-Site Request Forgery via Bulk Action Form
≤3.35Update to 3.36
- Medium6.5Authenticated (Contributor+) SQL Injection
≤3.34Update to 3.35
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.34Update to 3.35
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification
≤3.33Update to 3.34
- Medium6.5Authenticated (Contributor+) SQL Injection
≤3.32Update to 3.33
- Medium5.3Unauthenticated Limited File Read
≤3.29Update to 3.30
- Medium5.3Missing Authorization
≤3.29Update to 3.30
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤3.28Update to 3.29
- Medium4.3Authenticated (Author+) Limited File Deletion
≤3.27Update to 3.28
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes
≤3.26Update to 3.27
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤3.24Update to 3.25
- Medium6.1Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters
≤3.23Update to 3.24
- High7.2Authenticated (Administrator+) Remote Code Execution
≤3.19Update to 3.20
- High8.8Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action
≤3.18Update to 3.19
- Medium6.1Reflected Cross-Site Scripting
≤3.17Update to 3.18
- High8.8Authenticated (Contributor+) SQL Injection via order Parameter
≤3.16Update to 3.17
- Medium6.1Reflected Cross-Site Scripting via lang
≤3.15Update to 3.16
- High8.8Authenticated (Contributor+) SQL Injection via Shortcode
≤3.15Update to 3.16
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode
≤3.13Update to 3.14
- Medium6.4Authenticated (Contributor+) SQL Injection via Shortcode
≤3.13Update to 3.14
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤3.11Update to 3.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤3.10Update to 3.11
- Critical9.8Unauthenticated Local/Remote File Inclusion & Remote Code Execution
≤3.09Update to 3.10
- Medium6.1Reflected Cross-Site Scripting
≤3.0.7Update to 3.0.8
- High7.2Authenticated (Administrator+) SQL Injection
≤3.05Update to 3.06
- Medium5.3Information Disclosure
≤3.00Update to 3.01
- High7.5Local File Inclusion
≤2.81Update to 2.82
- Critical9.8Remote Code Execution via tax_query, meta_query, date_query Parameters
≤2.81Update to 2.82
- Medium6.1Authenticated Cross-Site Scripting
<2.82Update to 2.82
- Medium6.1Cross-Site Scripting
<2.7.4Update to 2.74
Media Library Assistant: common questions
Does Media Library Assistant have known vulnerabilities?
Yes. VulnCrest Radar lists 54 known vulnerabilities in Media Library Assistant: 2 critical, 10 high, 42 medium. None are known to affect version null.
How do I check which version of Media Library Assistant I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Media Library Assistant vulnerability?
CVE-2026-119491, published Nov 7, 2026: Media Library Assistant <= 3.43 - Missing Authorization. Severity: Medium (CVSS 4.3).
Is any Media Library Assistant vulnerability listed in CISA KEV?
No. None of the known Media Library Assistant vulnerabilities is currently listed in the CISA KEV catalog.