Media Library Assistant vulnerabilities
5 known vulnerabilities in Media Library Assistant from Dglingren. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.1 High severity
Media Library Assistant: Cross-Site Request Forgery
The Media Library Assistant plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.35 This is due to missing nonce verification on the bulk action handlers in the settings tab handlers. This makes it possible for u
- 8.8 High severity
Media Library Assistant: Unrestricted Upload of File with Dangerous Type
The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation involving the mla-inline-edit-upload-scripts AJAX action in all versions up to, and including, 3.18. This makes it possible for authent
- 8.8 High severity
Media Library Assistant: Improper Neutralization of Special Elements used in an SQL Command
The Media Library Assistant plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter within the mla_tag_cloud Shortcode in all versions up to, and including, 3.16 due to insufficient escaping on the user supplied parameter and l
- 7.7 High severity
Media Library Assistant: Improper Neutralization of Special Elements used in an SQL Command
The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and including, 3.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exist
- 9.8 Critical severity
Media Library Assistant: External Control of File Name or Path
The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from t