+ 26 vulnerabilidades conocidas más
| CVE |
Vulnerabilidad |
Tipo |
Gravedad |
Afectadas |
Corregido en |
Publicado |
Estado |
|
CVE-2025-31627
|
Media Library Assistant [media-library-assistant] < 3.25 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,9
|
< 3.25
|
3.25 |
2025-03-31 |
✓ corregido en la última versión
|
|
CVE-2024-11974
|
Media Library Assistant [media-library-assistant] < 3.24 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 3.24
|
3.24 |
2025-01-03 |
✓ corregido en la última versión
|
|
CVE-2024-51661
|
Media Library Assistant [media-library-assistant] < 3.20 |
Neutralización incorrecta de elementos especiales en un comando del sistema operativo (inyección de comandos del SO) |
Crítica
9,1
|
< 3.20
|
3.20 |
2024-11-01 |
✓ corregido en la última versión
|
|
CVE-2024-6823
|
Media Library Assistant [media-library-assistant] < 3.19 |
Carga de archivos sin restricción de tipo peligroso |
Alta
8,8
|
< 3.19
|
3.19 |
2024-08-12 |
✓ corregido en la última versión
|
|
CVE-2024-5544
|
Media Library Assistant [media-library-assistant] < 3.18 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 3.18
|
3.18 |
2024-07-01 |
✓ corregido en la última versión
|
|
CVE-2024-5605
|
Media Library Assistant [media-library-assistant] < 3.17 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Alta
8,8
|
< 3.17
|
3.17 |
2024-06-19 |
✓ corregido en la última versión
|
|
CVE-2024-3519
|
Media Library Assistant [media-library-assistant] < 3.16 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 3.16
|
3.16 |
2024-05-21 |
✓ corregido en la última versión
|
|
CVE-2024-3518
|
Media Library Assistant [media-library-assistant] < 3.16 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Media
6,5
|
< 3.16
|
3.16 |
2024-05-21 |
✓ corregido en la última versión
|
|
CVE-2024-2475
|
Media Library Assistant [media-library-assistant] < 3.14 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 3.14
|
3.14 |
2024-03-28 |
✓ corregido en la última versión
|
|
CVE-2024-2871
|
Media Library Assistant [media-library-assistant] < 3.14 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Alta
7,7
|
< 3.14
|
3.14 |
2024-03-25 |
✓ corregido en la última versión
|
|
CVE-2023-24385
|
Media Library Assistant [media-library-assistant] < 3.12 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,9
|
< 3.12
|
3.12 |
2023-10-02 |
✓ corregido en la última versión
|
|
CVE-2023-4716
|
Media Library Assistant [media-library-assistant] < 3.11 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 3.11
|
3.11 |
2023-09-21 |
✓ corregido en la última versión
|
|
CVE-2023-4634
|
Media Library Assistant [media-library-assistant] < 3.10 |
Control externo del nombre o la ruta de un archivo |
Crítica
9,8
|
< 3.10
|
3.10 |
2023-09-05 |
✓ corregido en la última versión
|
|
CVE-2023-34010
|
Media Library Assistant [media-library-assistant] < 3.0.8 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,8
|
< 3.0.8
|
3.0.8 |
2023-07-12 |
✓ corregido en la última versión
|
|
CVE-2023-0279
|
Media Library Assistant [media-library-assistant] < 3.06 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Alta
7,2
|
< 3.06
|
3.06 |
2023-02-16 |
✓ corregido en la última versión
|
|
CVE-2022-41618
|
Media Library Assistant [media-library-assistant] < 3.01 |
Exposición de información sensible a un actor no autorizado |
Baja
3,7
|
< 3.01
|
3.01 |
2022-09-29 |
✓ corregido en la última versión
|
|
—
|
Media Library Assistant [media-library-assistant] < 2.9.0 |
— |
Desconocido
|
< 2.9.0
|
2.9.0 |
2020-11-24 |
✓ corregido en la última versión
|
|
CVE-2020-11928
|
Media Library Assistant [media-library-assistant] < 2.82 |
— |
Crítica
9,8
|
< 2.82
|
2.82 |
2019-12-15 |
✓ corregido en la última versión
|
|
CVE-2020-11731
|
Media Library Assistant [media-library-assistant] < 2.82 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 2.82
|
2.82 |
2019-12-15 |
✓ corregido en la última versión
|
|
CVE-2020-11732
|
Media Library Assistant [media-library-assistant] < 2.82 |
— |
Alta
7,5
|
< 2.82
|
2.82 |
2019-12-15 |
✓ corregido en la última versión
|
|
CVE-2018-20982
|
Media Library Assistant [media-library-assistant] < 2.74 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 2.74
|
2.74 |
2018-05-28 |
✓ corregido en la última versión
|
|
CVE-2025-7035
|
Media Library Assistant [media-library-assistant] < 3.27 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 3.27
|
3.27 |
0000-00-00 |
✓ corregido en la última versión
|
|
CVE-2025-8357
|
Media Library Assistant [media-library-assistant] < 3.28 |
Falta de control de autorización |
Media
4,3
|
< 3.28
|
3.28 |
0000-00-00 |
✓ corregido en la última versión
|
|
CVE-2026-3072
|
Media Library Assistant [media-library-assistant] < 3.34 |
— |
Desconocido
|
< 3.34
|
3.34 |
0000-00-00 |
✓ corregido en la última versión
|
|
—
|
Media Library Assistant [media-library-assistant] < 3.29 |
— |
Media
5,9
|
< 3.29
|
3.29 |
0000-00-00 |
✓ corregido en la última versión
|
|
—
|
Media Library Assistant [media-library-assistant] < 2.90 |
— |
Desconocido
|
< 2.90
|
2.90 |
— |
✓ corregido en la última versión
|
CVE-2025-31627
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only impacts multi-site installations and installations where unfiltered_html has been disabled.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2024-11974
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘smc_settings_tab', 'unattachfixit-action', and 'woofixit-action’ parameters in all versions up to, and including, 3.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-51661
<p>WordPress Media Library Assistant Plugin <= 3.19 is vulnerable to Remote Code Execution (RCE)</p><p>Software: Media Library Assistant</p><p>Link: https://wordpress.org/plugins/media-library-assistant/#developers</p><p>Affected Version <= 3.19</p><p>Fixed in version 3.20 </p>
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2024-6823
The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation involving the mla-inline-edit-upload-scripts AJAX action in all versions up to, and including, 3.18. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-5544
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order parameter in all versions up to, and including, 3.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-5605
The Media Library Assistant plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter within the mla_tag_cloud Shortcode in all versions up to, and including, 3.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-3519
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the lang parameter in all versions up to, and including, 3.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-3518
The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and including, 3.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-2475
Update the WordPress Media Library Assistant plugin to the latest available version (at least 3.14).
stealthcopter discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Media Library Assistant Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.14.
Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2024-2871
The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and including, 3.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2023-24385
No patched version is available. Rejected by the vendor.
n0paew discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Media Library Assistant Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2023-4716
Update the WordPress Media Library Assistant plugin to the latest available version (at least 3.11).
Lana Codes discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Media Library Assistant Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.11.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2023-4634
The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from the ~/includes/mla-stream-image.php file, where images are processed via Imagick(). This makes it possible for unauthenticated attackers to supply files via FTP that will make directory lists, local file inclusion, and remote code execution possible.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2023-34010
Update the WordPress Media Library Assistant plugin to the latest available version (at least 3.0.8).
Phd discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Media Library Assistant Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.0.8.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2023-0279
Update the WordPress Media Library Assistant plugin to the latest available version (at least 3.06).
Daniel Krohmer (Fraunhofer IESE), Kunal Sharma (University of Kaiserslautern) discovered and reported this SQL Injection vulnerability in WordPress Media Library Assistant Plugin. This could allow a malicious actor to directly interact with your database, including but not limited to stealing information and creating new administrator accounts. This vulnerability has been fixed in version 3.06.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2022-41618
Unauthenticated Error Log Disclosure vulnerability discovered by Brandon Roldan (Patchstack Alliance) in WordPress Media Library Assistant plugin (versions <= 3.00).
Update the WordPress Media Library Assistant plugin to the latest available version (at least 3.01).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
Media Library Assistant [media-library-assistant] < 2.9.0
Authenticated Blind SQL Injection (SQLi) vulnerability found by Lenon Leite in WordPress Media Library Assistant plugin (versions <= 2.84).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2020-11928
In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_query parameter in mla_gallery via an admin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2020-11731
The Media Library Assistant plugin before 2.82 for Wordpress suffers from multiple XSS vulnerabilities in all Settings/Media Library Assistant tabs, which allow remote authenticated users to execute arbitrary JavaScript.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2020-11732
Unauthenticated Limited Local File Inclusion (LFI) vulnerability discovered by Daniel Monzón (stark0de) in WordPress Media Library Assistant plugin (versions <= 2.81).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2018-20982
The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2025-7035
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mla_tag_cloud and mla_term_list shortcodes in all versions up to, and including, 3.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2025-8357
The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file deletion in the /wp-content/uploads directory due to insufficient file path validation and user capability checking in the _process_mla_download_file function in all versions up to, and including, 3.27. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server from the /wp-content/uploads/ directory.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2026-3072
The Media Library Assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mla_update_compat_fields_action() function in all versions up to, and including, 3.33. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify taxonomy terms on arbitrary attachments.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
Media Library Assistant [media-library-assistant] < 3.29
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
Media Library Assistant [media-library-assistant] < 2.90
The Media Library Assistant WordPress plugin was affected by an authenticated (admin+) blind SQL injection vulnerability when there is at least one Custom Field Rule set in the plugin's options.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
Mantén Media Library Assistant actualizado — 3.39 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.