# Media Library Assistant

> Enhances the Media Library; powerful gallery and list shortcodes, full taxonomy support, IPTC/EXIF/XMP/PDF processing, bulk/quick edit.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:34 UTC.

## Facts (WordPress.org)

- Slug: `media-library-assistant`
- Author: David Lingren
- Version: 3.44
- Active installs: 70,000+
- Last update: 2026-10-28 (17 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 5.3.0, PHP 7.4
- Tags: categories, images, media, media library, tags
- Page: https://wordpress.org/plugins/media-library-assistant/

## Checks (against WordPress 7.1.4)

- OK: Updated 17 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Slows pages ↔ Speeds up, Inaccessible ↔ Accessible, Behind ↔ Current, Heavy ↔ Light, Pushy ↔ Fair, Closed ↔ Agent-ready.

## Known vulnerabilities

- 2026-11-01 MEDIUM: Missing Authorization (up to 3.43). CVE-2026-113481, https://www.wordfence.com/threat-intel/vulnerabilities/id/9607c9a9-29b3-47f0-a629-5a82d112b288?source=api-prod
- 2026-11-01 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.43). CVE-2026-113482, https://www.wordfence.com/threat-intel/vulnerabilities/id/6ab37e9e-032c-418b-a88b-23d730e2867f?source=api-prod
- 2026-10-29 MEDIUM: Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links (up to 3.42). CVE-2026-103875, https://www.wordfence.com/threat-intel/vulnerabilities/id/357d9d96-afb1-4b62-90cf-8d38a4cede0e?source=api-prod
- 2026-10-28 MEDIUM: Cross-Site Request Forgery (before 3.42). CVE-2026-113485, https://www.wordfence.com/threat-intel/vulnerabilities/id/0b93b20c-32ff-467f-82f7-31ef2bf13d8e?source=api-prod
- 2026-10-28 MEDIUM: Cross-Site Request Forgery (before 3.42). CVE-2026-113486, https://www.wordfence.com/threat-intel/vulnerabilities/id/c800a65a-e545-465c-84c7-a2cd3d393477?source=api-prod
- 2026-10-26 MEDIUM: Cross-Site Request Forgery (up to 3.42). CVE-2026-97295, https://www.wordfence.com/threat-intel/vulnerabilities/id/64bf69a8-7d6f-48a8-aabb-29945353cb93?source=api-prod
- 2026-10-26 MEDIUM: Authenticated (Contributor+) Information Exposure (up to 3.42). CVE-2026-115594, https://www.wordfence.com/threat-intel/vulnerabilities/id/ccce77cf-e9a9-4fbc-a99d-b9732dce3e73?source=api-prod
- 2026-10-26 MEDIUM: Authenticated (Author+) SQL Injection (up to 3.42). CVE-2026-115948, https://www.wordfence.com/threat-intel/vulnerabilities/id/5b5296ad-73c9-4a21-913a-47b3dc170a47?source=api-prod
- 2026-10-09 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 3.41). CVE-2026-95609, https://www.wordfence.com/threat-intel/vulnerabilities/id/5b989ad5-6c1d-4968-87e9-1af590140aa1?source=api-prod
- 2026-10-07 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.41). CVE-2026-97294, https://www.wordfence.com/threat-intel/vulnerabilities/id/4e907100-156d-4228-a2da-572af6d818e0?source=api-prod
- 2026-09-30 MEDIUM: Authenticated (Contributor+) SQL Injection (up to 3.41). CVE-2026-97293, https://www.wordfence.com/threat-intel/vulnerabilities/id/b152b6fa-66f3-4a43-9d6a-4f6c0b85acc7?source=api-prod
- 2026-09-11 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter (up to 3.35). CVE-2026-6640, https://www.wordfence.com/threat-intel/vulnerabilities/id/ac0abf8e-6efd-4cf5-ad03-8442d892a35f?source=api-prod
- 2026-09-11 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter (up to 3.35). CVE-2026-6641, https://www.wordfence.com/threat-intel/vulnerabilities/id/13602c35-a0f7-4651-af9a-0be9e581893a?source=api-prod
- 2026-09-11 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import (up to 3.35). CVE-2026-6642, https://www.wordfence.com/threat-intel/vulnerabilities/id/6e45dc8a-b777-4a49-b1b1-c59ffa75f5b4?source=api-prod
- 2026-08-21 MEDIUM: Authenticated (Author+) SQL Injection (before 3.40). CVE-2026-16959, https://www.wordfence.com/threat-intel/vulnerabilities/id/e554855b-a8d2-4187-9d86-c47d648a29ec?source=api-prod
- 2026-08-20 HIGH: Authenticated (Author+) Arbitrary File Upload (up to 3.39). CVE-2026-66600, https://www.wordfence.com/threat-intel/vulnerabilities/id/0db18319-6552-42f1-b304-aca61780c12c?source=api-prod
- 2026-08-20 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 3.39). CVE-2026-66601, https://www.wordfence.com/threat-intel/vulnerabilities/id/d87133a0-d24a-4c6a-8d6b-3867a319796a?source=api-prod
- 2026-08-18 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.39). CVE-2026-66591, https://www.wordfence.com/threat-intel/vulnerabilities/id/d2885b38-9e5a-4e06-ad1d-9c3b266f78a8?source=api-prod
- 2026-08-06 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 3.38). CVE-2026-61963, https://www.wordfence.com/threat-intel/vulnerabilities/id/736e0010-f1fc-42c4-8173-b81c5c78e34e?source=api-prod
- 2026-06-18 MEDIUM: Authenticated (Contributor+) SQL Injection (up to 3.35). CVE-2026-56012, https://www.wordfence.com/threat-intel/vulnerabilities/id/14a84b47-b176-475f-b983-00416b603fc4?source=api-prod
- 2026-06-16 MEDIUM: Reflected Cross-Site Scripting (up to 3.35). CVE-2026-54198, https://www.wordfence.com/threat-intel/vulnerabilities/id/4414cabb-765d-4ba9-be7a-acaf9ea6e45f?source=api-prod
- 2026-05-29 HIGH: Cross-Site Request Forgery via Bulk Action Form (up to 3.35). CVE-2026-6075, https://www.wordfence.com/threat-intel/vulnerabilities/id/0e399651-8992-4949-b7a7-4e8ce199b47a?source=api-prod
- 2026-04-06 MEDIUM: Authenticated (Contributor+) SQL Injection (up to 3.34). CVE-2026-34885, https://www.wordfence.com/threat-intel/vulnerabilities/id/2bb47ffd-1375-444c-8c55-05b59cb03f63?source=api-prod
- 2026-04-06 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.34). CVE-2026-34897, https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef402a9-b194-444c-9af4-5f79ab573beb?source=api-prod
- 2026-03-04 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification (up to 3.33). CVE-2026-3072, https://www.wordfence.com/threat-intel/vulnerabilities/id/2655f936-8177-4836-a0b0-1c637290a3bc?source=api-prod
- 2026-02-20 MEDIUM: Authenticated (Contributor+) SQL Injection (up to 3.32). CVE-2026-32399, https://www.wordfence.com/threat-intel/vulnerabilities/id/9f70377f-5b9d-4595-b22c-88aa30900a6f?source=api-prod
- 2025-10-17 MEDIUM: Unauthenticated Limited File Read (up to 3.29). CVE-2025-11738, https://www.wordfence.com/threat-intel/vulnerabilities/id/43d1264a-2265-4423-a643-7ef6436d3764?source=api-prod
- 2025-10-09 MEDIUM: Missing Authorization (up to 3.29). CVE-2025-63065, https://www.wordfence.com/threat-intel/vulnerabilities/id/5f902f32-342e-4d5c-9c2c-4ee682248b8a?source=api-prod
- 2025-09-22 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting (up to 3.28). CVE-2025-59590, https://www.wordfence.com/threat-intel/vulnerabilities/id/7a1b0440-743a-4c6f-aea5-bd46037dd149?source=api-prod
- 2025-08-18 MEDIUM: Authenticated (Author+) Limited File Deletion (up to 3.27). CVE-2025-8357, https://www.wordfence.com/threat-intel/vulnerabilities/id/8726375f-de67-4c92-9cf8-1bfb7330f327?source=api-prod
- 2025-07-15 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes (up to 3.26). CVE-2025-7035, https://www.wordfence.com/threat-intel/vulnerabilities/id/b6e02a2b-9033-4022-a7d7-1c81a7f02f83?source=api-prod
- 2025-03-31 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 3.24). CVE-2025-31627, https://www.wordfence.com/threat-intel/vulnerabilities/id/9eb1c2b3-527c-45b6-a1bd-dc9c553b8aa8?source=api-prod
- 2025-01-03 MEDIUM: Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters (up to 3.23). CVE-2024-11974, https://www.wordfence.com/threat-intel/vulnerabilities/id/65f4e5e1-4c2e-4943-aa84-4caa61e14bc2?source=api-prod
- 2024-11-01 HIGH: Authenticated (Administrator+) Remote Code Execution (up to 3.19). CVE-2024-51661, https://www.wordfence.com/threat-intel/vulnerabilities/id/bf527307-185b-4808-a3fc-d3ecafbd34e7?source=api-prod
- 2024-08-12 HIGH: Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action (up to 3.18). CVE-2024-6823, https://www.wordfence.com/threat-intel/vulnerabilities/id/9a446fe7-c97a-436e-b494-b924e6518297?source=api-prod
- 2024-07-01 MEDIUM: Reflected Cross-Site Scripting (up to 3.17). CVE-2024-5544, https://www.wordfence.com/threat-intel/vulnerabilities/id/cf0c34d3-5c7d-43a5-9430-2ebdc155123f?source=api-prod
- 2024-06-19 HIGH: Authenticated (Contributor+) SQL Injection via order Parameter (up to 3.16). CVE-2024-5605, https://www.wordfence.com/threat-intel/vulnerabilities/id/3ba8a9f5-0633-4cf0-af27-5466d93e9020?source=api-prod
- 2024-05-21 MEDIUM: Reflected Cross-Site Scripting via lang (up to 3.15). CVE-2024-3519, https://www.wordfence.com/threat-intel/vulnerabilities/id/7e1cdaf3-76fe-4b73-b30b-4554f0d34d11?source=api-prod
- 2024-05-21 HIGH: Authenticated (Contributor+) SQL Injection via Shortcode (up to 3.15). CVE-2024-3518, https://www.wordfence.com/threat-intel/vulnerabilities/id/a7af1a03-8382-4593-a41f-8cdb1bb9e53b?source=api-prod
- 2024-03-28 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode (up to 3.13). CVE-2024-2475, https://www.wordfence.com/threat-intel/vulnerabilities/id/63ed73c9-2b61-4811-ba7f-1803982f17bc?source=api-prod
- 2024-03-25 MEDIUM: Authenticated (Contributor+) SQL Injection via Shortcode (up to 3.13). CVE-2024-2871, https://www.wordfence.com/threat-intel/vulnerabilities/id/9e63fb84-a16b-447f-be73-e01f30881445?source=api-prod
- 2023-10-02 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting (up to 3.11). CVE-2023-24385, https://www.wordfence.com/threat-intel/vulnerabilities/id/a1603dc9-7f5e-47e1-8a81-27bb4df1aa4f?source=api-prod
- 2023-09-21 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (up to 3.10). CVE-2023-4716, https://www.wordfence.com/threat-intel/vulnerabilities/id/c5f6ae5d-7854-44c7-9fb8-efaa6e850d59?source=api-prod
- 2023-09-05 CRITICAL: Unauthenticated Local/Remote File Inclusion & Remote Code Execution (up to 3.09). CVE-2023-4634, https://www.wordfence.com/threat-intel/vulnerabilities/id/05c68377-feb6-442d-a3a0-1fbc246c7cbf?source=api-prod
- 2023-07-12 MEDIUM: Reflected Cross-Site Scripting (up to 3.0.7). CVE-2023-34010, https://www.wordfence.com/threat-intel/vulnerabilities/id/639009f6-9877-45a9-b9f3-7256bc6f3360?source=api-prod
- 2023-02-16 HIGH: Authenticated (Administrator+) SQL Injection (up to 3.05). CVE-2023-0279, https://www.wordfence.com/threat-intel/vulnerabilities/id/ecc59a6f-5e4a-44b4-932d-ed990ebb075a?source=api-prod
- 2022-09-29 MEDIUM: Information Disclosure (up to 3.00). CVE-2022-41618, https://www.wordfence.com/threat-intel/vulnerabilities/id/8b1cf5dc-c823-4603-959a-5dfc21f7d338?source=api-prod
- 2019-12-15 CRITICAL: Remote Code Execution via tax_query, meta_query, date_query Parameters (up to 2.81). CVE-2020-11928, https://www.wordfence.com/threat-intel/vulnerabilities/id/21456889-058c-46a5-80c3-a0c8f90cd3bf?source=api-prod
- 2019-12-15 MEDIUM: Authenticated Cross-Site Scripting (before 2.82). CVE-2020-11731, https://www.wordfence.com/threat-intel/vulnerabilities/id/bb581a8a-8e68-4f5a-8f05-d5b91b0f70d4?source=api-prod
- 2019-12-15 HIGH: Local File Inclusion (up to 2.81). CVE-2020-11732, https://www.wordfence.com/threat-intel/vulnerabilities/id/c49811bf-19d5-450f-9f11-a5fc9e8781c8?source=api-prod
- 2018-05-28 MEDIUM: Cross-Site Scripting (before 2.7.4). CVE-2018-20982, https://www.wordfence.com/threat-intel/vulnerabilities/id/9cfa4cb3-0f16-40be-9e78-ea378c3f535f?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=media-library-assistant · HTML: https://todaywp.com/plugins/media-library-assistant