Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Media Library Assistant 3.42 Clear all filters
TI-2026-81709 CVE-2026-113486 · GHSA-cr4r-w36f-j7h9

Forged requests delete trashed attachments in Media Library Assistant

Priority LOW 28

The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause a logged-in user with the Editor role or above to permanentl…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00134 Published 2026-10-28 Fixed in 3.42 CWE-352
TI-2026-81708 CVE-2026-113485 · GHSA-vj27-pxm6-rv65

CSRF in Media Library Assistant allows attachment deletion

Priority LOW 28

The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00134 Published 2026-10-28 Fixed in 3.42 CWE-352