Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

Media Library Assistant Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 32 vulnerability records associated with Media Library Assistant, published between 2018 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

32Total records
2Critical
7High
23Medium
0Low
0Informational
32Patched records
0Currently marked unpatched
2018-05-28First disclosure
2026-06-18Latest disclosure
32 of 32CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
201811 records
201933 records
202211 records
202355 records
202488 records
202577 records
202677 records

Severity Breakdown

SeverityRecordsShare
Critical26.3%
High721.9%
Medium2371.9%

Vulnerability-Type Breakdown

Cross-Site Scripting

14 records43.8%

First: 2018. Latest: 2026.

SQL Injection

7 records21.9%

First: 2023. Latest: 2026.

Path Traversal

3 records9.4%

First: 2019. Latest: 2025.

Missing Authorization

3 records9.4%

First: 2025. Latest: 2026.

Other

2 records6.3%

First: 2019. Latest: 2024.

Information Disclosure

1 record3.1%

First: 2022. Latest: 2022.

Arbitrary File Upload

1 record3.1%

First: 2024. Latest: 2024.

CSRF

1 record3.1%

First: 2026. Latest: 2026.

Patch Status

Patched
32
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 3.36
  • 3.35
  • 3.34
  • 3.33
  • 3.30
  • 3.29
  • 3.28
  • 3.27
  • 3.25
  • 3.24
  • 3.20
  • 3.19
  • 3.18
  • 3.17
  • 3.16
  • 3.14
  • 3.12
  • 3.11
  • 3.10
  • 3.0.8
  • 3.06
  • 3.01
  • 2.82
  • 2.74

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
*-3.0.7Media Library Assistant <= 3.07 - Reflected Cross-Site ScriptingJuly 12, 20233.0.8Medium
*-3.05Media Library Assistant <= 3.05 - Authenticated (Administrator+) SQL InjectionFebruary 16, 20233.06High
*-3.00Media Library Assistant <= 3.00 - Information DisclosureSeptember 29, 20223.01Medium
*-2.81Media Library Assistant <= 2.81 - Local File InclusionDecember 15, 20192.82High
[*, 2.82)Media Library Assistant <= 2.81 - Authenticated Cross-Site ScriptingDecember 15, 20192.82Medium
*-2.81Media Library Assistant <= 2.81 - Remote Code Execution via tax_query, meta_query, date_query ParametersDecember 15, 20192.82Critical
[*, 2.7.4)Media Library Assistant <= 2.73 - Cross-Site ScriptingMay 28, 20182.74Medium

Selected source records

Latest Records

MediumCVE-2026-56012

Media Library Assistant <= 3.35 - Authenticated (Contributor+) SQL Injection

Published: June 18, 2026

Affected versions
*-3.35
Patched versions
3.36
Original Wordfence record
MediumCVE-2026-54198

Media Library Assistant <= 3.35 - Reflected Cross-Site Scripting

Published: June 15, 2026

Affected versions
*-3.35
Patched versions
3.36
Original Wordfence record
HighCVE-2026-6075

Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form

Published: May 28, 2026

Affected versions
*-3.35
Patched versions
3.36
Original Wordfence record
MediumCVE-2026-34885

Media Library Assistant <= 3.34 - Authenticated (Contributor+) SQL Injection

Published: April 6, 2026

Affected versions
*-3.34
Patched versions
3.35
Original Wordfence record
MediumCVE-2026-34897

Media Library Assistant <= 3.34 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: April 6, 2026

Affected versions
*-3.34
Patched versions
3.35
Original Wordfence record
MediumCVE-2026-3072

Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification

Published: March 4, 2026

Affected versions
*-3.33
Patched versions
3.34
Original Wordfence record
MediumCVE-2026-32399

Media LIbrary Assistant <= 3.32 - Authenticated (Contributor+) SQL Injection

Published: February 20, 2026

Affected versions
*-3.32
Patched versions
3.33
Original Wordfence record
MediumCVE-2025-11738

Media Library Assistant <= 3.29 - Unauthenticated Limited File Read

Published: October 17, 2025

Affected versions
*-3.29
Patched versions
3.30
Original Wordfence record

Highest-Severity Records

CriticalCVE-2023-4634

Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution

Published: September 5, 2023

Affected versions
*-3.09
Patched versions
3.10
Original Wordfence record
CriticalCVE-2020-11928

Media Library Assistant <= 2.81 - Remote Code Execution via tax_query, meta_query, date_query Parameters

Published: December 15, 2019

Affected versions
*-2.81
Patched versions
2.82
Original Wordfence record
HighCVE-2024-5605

Media Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameter

Published: June 19, 2024

Affected versions
*-3.16
Patched versions
3.17
Original Wordfence record
HighCVE-2024-6823

Media Library Assistant <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action

Published: August 12, 2024

Affected versions
*-3.18
Patched versions
3.19
Original Wordfence record
HighCVE-2024-3518

Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode

Published: May 21, 2024

Affected versions
*-3.15
Patched versions
3.16
Original Wordfence record
HighCVE-2026-6075

Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form

Published: May 28, 2026

Affected versions
*-3.35
Patched versions
3.36
Original Wordfence record
HighCVE-2020-11732

Media Library Assistant <= 2.81 - Local File Inclusion

Published: December 15, 2019

Affected versions
*-2.81
Patched versions
2.82
Original Wordfence record
HighCVE-2024-51661

Media Library Assistant <= 3.19 - Authenticated (Administrator+) Remote Code Execution

Published: November 1, 2024

Affected versions
*-3.19
Patched versions
3.20
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory