Advisories · Technology
dglingren Media Library Assistant.
Every CVE that names dglingren Media Library Assistant among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.7 Medium
Media Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links
- dglingren Media Library Assistant
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter
- dglingren Media Library Assistant
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import
- dglingren Media Library Assistant
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter
- dglingren Media Library Assistant
- Cross-site scripting (XSS)
- CVSS 8.1 High
Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form
- dglingren Media Library Assistant
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification
- dglingren Media Library Assistant
- Broken access control
- CVSS 5.3 Medium
Media Library Assistant <= 3.29 - Unauthenticated Limited File Read
- dglingren Media Library Assistant
- Path traversal
- CVSS 4.3 Medium
Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion
- dglingren Media Library Assistant
- Broken access control
- CVSS 6.4 Medium
Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes
- dglingren Media Library Assistant
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Media Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters
- dglingren Media Library Assistant
- Cross-site scripting (XSS)
- CVSS 8.8 High
Media Library Assistant <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action
- dglingren Media Library Assistant
- Unrestricted file upload
- CVSS 6.1 Medium
Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting
- dglingren Media Library Assistant
- Cross-site scripting (XSS)
- CVSS 8.8 High
Media Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameter
- dglingren Media Library Assistant
- SQL injection
- CVSS 8.8 High
Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode
- dglingren Media Library Assistant
- SQL injection
- CVSS 6.1 Medium
Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang
- dglingren Media Library Assistant
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Media Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcode
- dglingren Media Library Assistant
- SQL injection
- CVSS 6.4 Medium
Media Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode
- dglingren Media Library Assistant
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Media Library Assistant <= 3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- dglingren Media Library Assistant
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution
- dglingren Media Library Assistant
- Path traversal