6.8
Medium
CVE-2026-16959 The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it…
Description
The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Media Library Assistant 3.40 | earliest → < 3.40 | 3.40 |
Other CVEs of Media Library Assistant
The 6 CVEs of Media Library Assistant →
CVE-2026-113482
The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before…
6.8
Medium
CVE-2026-113481
The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a…
4.3
Medium
CVE-2026-113486
The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action,…
6.5
Medium
CVE-2026-113485
The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media…
6.5
Medium