Threat database

CVE-2026-95609 is a stored cross-site scripting (XSS) vulnerability in the David Lingren Media LIbrary Assistant plugin. It affects versions from the initial release up to 3.41 inclusive. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that can execute in users' browsers. The CVSS 3.1 score is 7.1, indicating a high severity with potential impacts on confidentiality, integrity, and availability. There is no information about an available patch or official fix at this time.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through 3.41.

Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.

CVE-2026-66601 is a medium severity cross-site scripting (XSS) vulnerability affecting Media LIbrary Assistant versions up to 3.39. It involves improper neutralization of input during web page generation, allowing a subscriber-level user to potentially execute malicious scripts. The vulnerability has a CVSS 3.1 score of 6.5, indicating a moderate risk with impact on confidentiality, integrity, and availability. No specific affected versions or patches are provided in the available data.

CVE-2026-66600 is a critical vulnerability in David Lingren's Media LIbrary Assistant allowing authenticated users with high privileges to upload arbitrary files without restriction on file type. This affects versions up to 3.39. The vulnerability can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-66591 is a stored cross-site scripting (XSS) vulnerability in David Lingren Media LIbrary Assistant. It arises from improper neutralization of input during web page generation. The vulnerability affects versions up to and including 3.39. Exploitation could lead to partial confidentiality, integrity, and availability impacts. The CVSS score is 6.5, indicating a medium severity level.

CVE-2026-61963 is a high severity unauthenticated cross-site scripting (XSS) vulnerability in Media LIbrary Assistant versions up to and including 3.38. This vulnerability allows an attacker to inject malicious scripts during web page generation due to improper input neutralization. The vulnerability has a CVSS score of 7.1, indicating a significant risk but no known exploits in the wild or official patches at this time.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant allows Blind SQL Injection. This issue affects Media LIbrary Assistant: from n/a through 3.35.

Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.35 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through 3.34.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant allows SQL Injection.This issue affects Media LIbrary Assistant: from n/a through 3.34.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind SQL Injection.This issue affects Media LIbrary Assistant: from n/a through <= 3.32.

Authorization Bypass Through User-Controlled Key vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media LIbrary Assistant: from n/a through <= 3.29.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through <= 3.28.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through <= 3.24.

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Command Injection.This issue affects Media LIbrary Assistant: from n/a through <= 3.19.