dglingren Media Library Assistant

• CVE-2026-103875 Medium 4.7 Media Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links 0.3%
• CVE-2026-6640 Medium 6.4 Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter 0.4%
• CVE-2026-6642 Medium 6.4 Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import 0.4%
• CVE-2026-6641 Medium 6.4 Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter 0.4%
• CVE-2026-6075 High 8.1 Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form 0.2%
• CVE-2026-3072 Medium 4.3 Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification 0.2%
• CVE-2025-11738 Medium 5.3 Media Library Assistant <= 3.29 - Unauthenticated Limited File Read 0.4%
• CVE-2025-8357 Medium 4.3 Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion 0.3%
• CVE-2025-7035 Medium 6.4 Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes 0.3%
• CVE-2024-11974 Medium 6.1 Media Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters 0.4%
• CVE-2024-6823 High 8.8 Media Library Assistant <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action 1.3%
• CVE-2024-5544 Medium 6.1 Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting 0.4%
• CVE-2024-5605 High 8.8 Media Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameter 0.6%
• CVE-2024-3518 High 8.8 Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode 0.5%
• CVE-2024-3519 Medium 6.1 Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang 0.3%
• CVE-2024-2871 Medium 6.4 Media Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcode 0.5%
• CVE-2024-2475 Medium 6.4 Media Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode 0.4%
• CVE-2023-4716 Medium 6.4 Media Library Assistant <= 3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.5%
• CVE-2023-4634 Critical 9.8 Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution 85.6%