CVE-2026-61963

Subscriber Cross Site Scripting (XSS) in Media Library Assistant <= 3.39 versions.

Author Arbitrary File Upload vulnerability in Media Library Assistant versions up to 3.39. A user with author role can upload malicious files.

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media Library Assistant allows Stored XSS. This issue affects Media Library Assistant from n/a through 3.39.

An unauthenticated Cross Site Scripting (XSS) vulnerability has been identified in Media Library Assistant versions up to 3.35. An attacker can exploit this flaw to inject malicious JavaScript code.

The Media Library Assistant plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 3.35. This is due to missing nonce verification on the bulk action handlers in the settings tab handlers, allowing unauthenticated attackers to trick an administrator into performing bulk delete, edit, or purge operations on plugin settings and attachment metadata via a forged request.