Vulnerabilities

TI-2025-00791 CVE-2025-0935 · GHSA-g6w7-7678-67j9

Media Library Folders <= 8.3.0 - Missing Authorization to Plugin Settings Change

LOW 20

The Media Library Folders plugin for WordPress is vulnerable to unauthorized plugin settings change due to a missing capability check on several AJAX actions in all versions up to, and including, 8.3.0.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00336 Published 2025-02-15 No fix listed CWE-862

TI-2024-07283 CVE-2024-7858 · GHSA-cj98-64q3-8v62

Media Library Folders <= 8.2.3 - Missing Authorization on Various Functions

LOW 28

The Media Library Folders plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several AJAX functions in the media-library-plus.php file in all versions up to, and including, 8.2.…

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00331 Published 2024-08-30 No fix listed CWE-862

TI-2024-07282 CVE-2024-7857 · GHSA-967p-q58c-5vc2

Media Library Folders <= 8.2.2 - Authenticated (Subscriber+) Second-Order SQL Injection

LOW 37

The Media Library Folders plugin for WordPress is vulnerable to second order SQL Injection via the 'sort_type' parameter of the 'mlf_change_sort_type' AJAX action in all versions up to, and including, 8.2.2 due to insuff…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00451 Published 2024-08-29 No fix listed CWE-89

TI-2024-03370 CVE-2024-3615 · GHSA-v4qv-r5g6-wxrp

Media Library Folders <= 8.2.0 - Reflected Cross-Site Scripting via 's'

LOW 27

The Media Library Folders plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 8.2.0 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00385 Published 2024-04-19 No fix listed CWE-79

TI-2024-20663 CVE-2024-31287 · GHSA-p52c-jr7p-8c89

WordPress Media Library Folders plugin <= 8.1.8 - Directory Traversal vulnerability

LOW 30

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Max Foundry Media Library Folders.This issue affects Media Library Folders: from n/a through 8.1.8.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00661 Published 2024-04-10 No fix listed CWE-22

TI-2024-20210 CVE-2024-30486 · GHSA-f37h-g74v-g4mp

WordPress Media Library Folders plugin <= 8.1.7 - Auth. SQL Injection vulnerability

LOW 39

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Max Foundry Media Library Folders.This issue affects Media Library Folders: from n/a through 8.1.7.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00577 Published 2024-03-29 No fix listed CWE-89

TI-2022-20032 CVE-2022-41634 · GHSA-m72j-3hvm-r6gx

WordPress Media Library Folders plugin <= 7.1.1 - Cross-Site Request Forgery (CSRF) vulnerability

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00312 Published 2022-11-18 No fix listed CWE-352