CVE-2026-6640

Subscriber Cross Site Scripting (XSS) in Media Library Assistant <= 3.39 versions.

Author Arbitrary File Upload vulnerability in Media Library Assistant versions up to 3.39. A user with author role can upload malicious files.

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. Due to insufficient output escaping on preset field values in HTML attribute contexts, an authenticated attacker with Author-level access and above can inject malicious scripts that execute when an administrator imports the poisoned preset and the targeted input field receives focus.

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up to and including 3.35. Due to insufficient input sanitization and output escaping on the mla_link_href parameter, an authenticated attacker with contributor-level access and above can inject arbitrary web scripts in pages that execute whenever a user accesses an injected page.

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media Library Assistant allows Stored XSS. This issue affects Media Library Assistant from n/a through 3.39.

Unauthenticated Cross Site Scripting (XSS) in Media Library Assistant versions up to and including 3.38.

An unauthenticated Cross Site Scripting (XSS) vulnerability has been identified in Media Library Assistant versions up to 3.35. An attacker can exploit this flaw to inject malicious JavaScript code.

The Media Library Assistant plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 3.35. This is due to missing nonce verification on the bulk action handlers in the settings tab handlers, allowing unauthenticated attackers to trick an administrator into performing bulk delete, edit, or purge operations on plugin settings and attachment metadata via a forged request.