Plugin security history

Media Library Assistant Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 32 vulnerability records associated with Media Library Assistant, published between 2018 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

32Total records

2Critical

7High

23Medium

0Low

0Informational

32Patched records

0Currently marked unpatched

2018-05-28First disclosure

2026-06-18Latest disclosure

32 of 32CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2018	1	1 records
2019	3	3 records
2022	1	1 records
2023	5	5 records
2024	8	8 records
2025	7	7 records
2026	7	7 records

Severity Breakdown

Severity	Records	Share
Critical	2	6.3%
High	7	21.9%
Medium	23	71.9%

Vulnerability-Type Breakdown

Cross-Site Scripting

14 records43.8%

First: 2018. Latest: 2026.

SQL Injection

7 records21.9%

First: 2023. Latest: 2026.

Path Traversal

3 records9.4%

First: 2019. Latest: 2025.

Missing Authorization

3 records9.4%

First: 2025. Latest: 2026.

Other

2 records6.3%

First: 2019. Latest: 2024.

Information Disclosure

1 record3.1%

First: 2022. Latest: 2022.

Arbitrary File Upload

1 record3.1%

First: 2024. Latest: 2024.

CSRF

1 record3.1%

First: 2026. Latest: 2026.

Patch Status

Patched: 32
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

3.36
3.35
3.34
3.33
3.30
3.29
3.28
3.27
3.25
3.24
3.20
3.19
3.18
3.17
3.16
3.14
3.12
3.11
3.10
3.0.8
3.06
3.01
2.82
2.74

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-3.35`	Media Library Assistant <= 3.35 - Authenticated (Contributor+) SQL Injection	June 18, 2026	3.36	Medium
`*-3.35`	Media Library Assistant <= 3.35 - Reflected Cross-Site Scripting	June 15, 2026	3.36	Medium
`*-3.35`	Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form	May 28, 2026	3.36	High
`*-3.34`	Media Library Assistant <= 3.34 - Authenticated (Contributor+) Stored Cross-Site Scripting	April 6, 2026	3.35	Medium
`*-3.34`	Media Library Assistant <= 3.34 - Authenticated (Contributor+) SQL Injection	April 6, 2026	3.35	Medium
`*-3.33`	Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification	March 4, 2026	3.34	Medium
`*-3.32`	Media LIbrary Assistant <= 3.32 - Authenticated (Contributor+) SQL Injection	February 20, 2026	3.33	Medium
`*-3.29`	Media Library Assistant <= 3.29 - Unauthenticated Limited File Read	October 17, 2025	3.30	Medium
`*-3.29`	Media Library Assistant <= 3.29 - Missing Authorization	October 9, 2025	3.30	Medium
`*-3.28`	Media Library Assistant <= 3.28 - Authenticated (Author+) Stored Cross-Site Scripting	September 22, 2025	3.29	Medium
`*-3.27`	Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion	August 18, 2025	3.28	Medium
`*-3.26`	Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes	July 15, 2025	3.27	Medium
`*-3.24`	Media Library Assistant <= 3.24 - Authenticated (Administrator+) Stored Cross-Site Scripting	March 31, 2025	3.25	Medium
`*-3.23`	Media Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters	January 3, 2025	3.24	Medium
`*-3.19`	Media Library Assistant <= 3.19 - Authenticated (Administrator+) Remote Code Execution	November 1, 2024	3.20	High
`*-3.18`	Media Library Assistant <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action	August 12, 2024	3.19	High
`*-3.17`	Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting	July 1, 2024	3.18	Medium
`*-3.16`	Media Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameter	June 19, 2024	3.17	High
`*-3.15`	Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang	May 21, 2024	3.16	Medium
`*-3.15`	Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode	May 21, 2024	3.16	High
`*-3.13`	Media Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode	March 28, 2024	3.14	Medium
`*-3.13`	Media Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcode	March 25, 2024	3.14	Medium
`*-3.11`	Media Library Assistant <= 3.11 - Authenticated (Author+) Stored Cross-Site Scripting	October 2, 2023	3.12	Medium
`*-3.10`	Media Library Assistant <= 3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	September 21, 2023	3.11	Medium
`*-3.09`	Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution	September 5, 2023	3.10	Critical

Selected source records

Latest Records

MediumCVE-2026-56012

Media Library Assistant <= 3.35 - Authenticated (Contributor+) SQL Injection

Published: June 18, 2026

Affected versions: *-3.35
Patched versions: 3.36

Original Wordfence record

MediumCVE-2026-54198

Media Library Assistant <= 3.35 - Reflected Cross-Site Scripting

Published: June 15, 2026

Affected versions: *-3.35
Patched versions: 3.36

Original Wordfence record

HighCVE-2026-6075

Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form

Published: May 28, 2026

Affected versions: *-3.35
Patched versions: 3.36

Original Wordfence record

MediumCVE-2026-34885

Media Library Assistant <= 3.34 - Authenticated (Contributor+) SQL Injection

Published: April 6, 2026

Affected versions: *-3.34
Patched versions: 3.35

Original Wordfence record

MediumCVE-2026-34897

Media Library Assistant <= 3.34 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: April 6, 2026

Affected versions: *-3.34
Patched versions: 3.35

Original Wordfence record

MediumCVE-2026-3072

Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification

Published: March 4, 2026

Affected versions: *-3.33
Patched versions: 3.34

Original Wordfence record

MediumCVE-2026-32399

Media LIbrary Assistant <= 3.32 - Authenticated (Contributor+) SQL Injection

Published: February 20, 2026

Affected versions: *-3.32
Patched versions: 3.33

Original Wordfence record

MediumCVE-2025-11738

Media Library Assistant <= 3.29 - Unauthenticated Limited File Read

Published: October 17, 2025

Affected versions: *-3.29
Patched versions: 3.30

Original Wordfence record

Highest-Severity Records

CriticalCVE-2023-4634

Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution

Published: September 5, 2023

Affected versions: *-3.09
Patched versions: 3.10

Original Wordfence record

CriticalCVE-2020-11928

Media Library Assistant <= 2.81 - Remote Code Execution via tax_query, meta_query, date_query Parameters

Published: December 15, 2019

Affected versions: *-2.81
Patched versions: 2.82

Original Wordfence record

HighCVE-2024-5605

Media Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameter

Published: June 19, 2024

Affected versions: *-3.16
Patched versions: 3.17

Original Wordfence record

HighCVE-2024-6823

Media Library Assistant <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action

Published: August 12, 2024

Affected versions: *-3.18
Patched versions: 3.19

Original Wordfence record

HighCVE-2024-3518

Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode

Published: May 21, 2024

Affected versions: *-3.15
Patched versions: 3.16

Original Wordfence record

HighCVE-2026-6075

Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form

Published: May 28, 2026

Affected versions: *-3.35
Patched versions: 3.36

Original Wordfence record

HighCVE-2020-11732

Media Library Assistant <= 2.81 - Local File Inclusion

Published: December 15, 2019

Affected versions: *-2.81
Patched versions: 2.82

Original Wordfence record

HighCVE-2024-51661

Media Library Assistant <= 3.19 - Authenticated (Administrator+) Remote Code Execution

Published: November 1, 2024

Affected versions: *-3.19
Patched versions: 3.20

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory