WordPress media-library-assistant has 17 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2023-4634 | The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and incl | critical | 9.8 | <3.10 | 3.10 |
| CVE-2020-11732 | The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_gallery link=download. | high | 7.5 | <2.82 | 2.82 |
| CVE-2020-11928 | In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_quer | critical | 9.8 | <2.82 | 2.82 |
| CVE-2024-6823 | The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation involving the m | high | 8.8 | <3.19 | 3.19 |
| CVE-2020-11731 | The Media Library Assistant plugin before 2.82 for Wordpress suffers from multiple XSS vulnerabilities in all Settings/Media Library Assista | medium | 6.1 | <2.82 | 2.82 |
| CVE-2018-20982 | The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin subme | medium | 6.1 | <2.74 | 2.74 |
| CVE-2023-0279 | The Media Library Assistant WordPress plugin before 3.06 does not properly sanitise and escape a parameter before using it in a SQL statemen | high | 7.2 | <3.06 | 3.06 |
| CVE-2022-41618 | Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin <= 3.00 on WordPress. | low | 3.7 | <3.01 | 3.01 |
| CVE-2024-5605 | The Media Library Assistant plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter within the mla_tag_clou | high | 8.8 | <3.17 | 3.17 |
| CVE-2023-4716 | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up | medium | 6.4 | <=3.10 | – |
| CVE-2024-3518 | The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and inc | high | 8.8 | <3.16 | 3.16 |
| CVE-2024-2871 | The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and inc | medium | 6.4 | <3.14 | 3.14 |
| CVE-2024-2475 | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up | medium | 6.4 | <3.14 | 3.14 |
| CVE-2024-11974 | The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘smc_settings_tab', 'unattachfixit- | medium | 6.1 | <=3.23 | – |
| CVE-2024-5544 | The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order parameter in all versions up | medium | 6.1 | <3.18 | 3.18 |
| CVE-2025-7035 | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mla_tag_cloud and mla_term_li | medium | 6.4 | <3.27 | 3.27 |
| CVE-2024-3519 | The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the lang parameter in all versions up t | medium | 6.1 | <3.16 | 3.16 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked