WordPress plugin

Media Library Assistant security & vulnerabilities

Q: Is any Media Library Assistant vulnerability listed in CISA KEV?

No. None of the known Media Library Assistant vulnerabilities is currently listed in the CISA KEV catalog.

media-library-assistant— active installsLast vulnerability Nov 7, 2026

No known unpatched vulnerabilities in the latest version

All 54 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin

54Known vulnerabilities

Critical2
High10
Medium42
Low0

Vulnerabilities per year

All Media Library Assistant vulnerabilities

Media Library Assistant vulnerabilities
Severity	Vulnerability	CVE	Published
High7.2	Unauthenticated Stored Cross-Site Scripting ≤3.41Update to 3.42	CVE-2026-95609	Oct 03
High8.8	Authenticated (Author+) Arbitrary File Upload ≤3.39Update to 3.40	CVE-2026-66600	Aug 19
High7.2	Unauthenticated Stored Cross-Site Scripting ≤3.38Update to 3.39	CVE-2026-61963	Aug 04
High8.1	Cross-Site Request Forgery via Bulk Action Form ≤3.35Update to 3.36	CVE-2026-6075	May 28
High7.2	Authenticated (Administrator+) Remote Code Execution ≤3.19Update to 3.20	CVE-2024-51661	Nov 1, 2024
High8.8	Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action ≤3.18Update to 3.19	CVE-2024-6823	Aug 12, 2024
High8.8	Authenticated (Contributor+) SQL Injection via order Parameter ≤3.16Update to 3.17	CVE-2024-5605	Jun 19, 2024
High8.8	Authenticated (Contributor+) SQL Injection via Shortcode ≤3.15Update to 3.16	CVE-2024-3518	May 21, 2024
Critical9.8	Unauthenticated Local/Remote File Inclusion & Remote Code Execution ≤3.09Update to 3.10	CVE-2023-4634	Sep 5, 2023
High7.2	Authenticated (Administrator+) SQL Injection ≤3.05Update to 3.06	CVE-2023-0279	Feb 16, 2023
High7.5	Local File Inclusion ≤2.81Update to 2.82	CVE-2020-11732	Dec 15, 2019
Critical9.8	Remote Code Execution via tax_query, meta_query, date_query Parameters ≤2.81Update to 2.82	CVE-2020-11928	Dec 15, 2019

High7.2
Unauthenticated Stored Cross-Site Scripting
≤3.41Update to 3.42
CVE-2026-95609Oct 03
High8.8
Authenticated (Author+) Arbitrary File Upload
≤3.39Update to 3.40
CVE-2026-66600Aug 19
High7.2
Unauthenticated Stored Cross-Site Scripting
≤3.38Update to 3.39
CVE-2026-61963Aug 04
High8.1
Cross-Site Request Forgery via Bulk Action Form
≤3.35Update to 3.36
CVE-2026-6075May 28
High7.2
Authenticated (Administrator+) Remote Code Execution
≤3.19Update to 3.20
CVE-2024-51661Nov 1, 2024
High8.8
Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action
≤3.18Update to 3.19
CVE-2024-6823Aug 12, 2024
High8.8
Authenticated (Contributor+) SQL Injection via order Parameter
≤3.16Update to 3.17
CVE-2024-5605Jun 19, 2024
High8.8
Authenticated (Contributor+) SQL Injection via Shortcode
≤3.15Update to 3.16
CVE-2024-3518May 21, 2024
Critical9.8
Unauthenticated Local/Remote File Inclusion & Remote Code Execution
≤3.09Update to 3.10
CVE-2023-4634Sep 5, 2023
High7.2
Authenticated (Administrator+) SQL Injection
≤3.05Update to 3.06
CVE-2023-0279Feb 16, 2023
High7.5
Local File Inclusion
≤2.81Update to 2.82
CVE-2020-11732Dec 15, 2019
Critical9.8
Remote Code Execution via tax_query, meta_query, date_query Parameters
≤2.81Update to 2.82
CVE-2020-11928Dec 15, 2019

Media Library Assistant: common questions

Does Media Library Assistant have known vulnerabilities?

Yes. VulnCrest Radar lists 54 known vulnerabilities in Media Library Assistant: 2 critical, 10 high, 42 medium. None are known to affect version null.

How do I check which version of Media Library Assistant I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Media Library Assistant vulnerability?

CVE-2026-119491, published Nov 7, 2026: Media Library Assistant <= 3.43 - Missing Authorization. Severity: Medium (CVSS 4.3).

Is any Media Library Assistant vulnerability listed in CISA KEV?

No. None of the known Media Library Assistant vulnerabilities is currently listed in the CISA KEV catalog.