Media Library Assistant Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode – CVE-2024-2475 |WordPress Plugin Vulnerability Report 

Plugin Name: Media Library Assistant

Key Information:

  • Software Type: Plugin
  • Software Slug: media-library-assistant
  • Software Status: Active
  • Software Author: dglingren
  • Software Downloads: 1,901,312
  • Active Installs: 70,000
  • Last Updated: April 1, 2024
  • Patched Versions: 3.14
  • Affected Versions: <= 3.13

Vulnerability Details:

  • Name: Media Library Assistant <= 3.13
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-2475
  • CVSS Score: 6.4
  • Publicly Published: March 28, 2024
  • Researcher: stealthcopter
  • Description: The Media Library Assistant plugin, an essential tool for managing media libraries on WordPress sites, is susceptible to Stored Cross-Site Scripting (XSS) in versions up to 3.13. The vulnerability stems from the plugin's handling of the 'mla_gallery' shortcode, where insufficient input sanitization and output escaping allow attackers with contributor-level access to inject malicious scripts. These scripts can be executed by users accessing the compromised pages, posing a significant security risk.


The Media Library Assistant plugin, widely utilized for its advanced media management capabilities, has been identified to contain a Stored Cross-Site Scripting vulnerability in versions up to and including 3.13. This security risk has been effectively neutralized in the subsequent patch, version 3.14.

Detailed Overview:

Discovered by the cybersecurity researcher known as stealthcopter, this vulnerability highlights the critical importance of stringent input validation within plugins. By exploiting this vulnerability, authenticated users could introduce harmful scripts into web pages, compromising site integrity and user security. The release of version 3.14 by the plugin's developers promptly addresses this issue, reinforcing the plugin's defenses against such exploits.

Advice for Users:

  • Immediate Action: Users of the Media Library Assistant plugin are urged to update to the patched version 3.14 without delay to fortify their sites against this vulnerability.
  • Check for Signs of Vulnerability: Administrators should inspect their websites for any unusual activity or unauthorized content alterations, which may signal exploitation.
  • Alternate Plugins: While the patched version resolves the immediate concern, users maintaining a cautious stance may explore alternative media library management plugins that fulfill similar needs.
  • Stay Updated: Keeping all WordPress plugins up-to-date is paramount for securing your site from known vulnerabilities. Regular updates are a cornerstone of effective web security.


The swift resolution of the Stored Cross-Site Scripting vulnerability within the Media Library Assistant plugin underscores the ongoing battle for digital security and the pivotal role of timely updates. By ensuring that their installations are updated to version 3.14 or later, users can safeguard their WordPress sites against this and potential future vulnerabilities, maintaining the trust and safety of their digital environments.


Detailed Report: 

In the dynamic world of WordPress, where plugins like Media Library Assistant enhance the digital experience for millions, the shadow of security vulnerabilities looms large, threatening to compromise the sanctity of our digital domains. The recent identification of a Stored Cross-Site Scripting (XSS) vulnerability, CVE-2024-2475, within Media Library Assistant—up to and including version 3.13—serves as a stark reminder of the critical importance of maintaining updated and secure web assets. This discovery underscores the ever-present need for vigilance in the digital realm, where the security of a website is as vital as its content.

About Media Library Assistant:

Media Library Assistant, developed by dglingren, is a cornerstone plugin for WordPress users, facilitating advanced media library management. With over 1.9 million downloads and 70,000 active installations, its impact is widespread, making any vulnerabilities within it a concern for a significant portion of the WordPress community.

Unveiling the Vulnerability:

CVE-2024-2475 exposes a significant risk through the 'mla_gallery' shortcode, where inadequate input sanitization and output escaping could allow attackers with contributor-level access to inject harmful scripts. Uncovered by researcher stealthcopter, this vulnerability could lead to unauthorized script executions, compromising both site integrity and user data security.

Risks and Potential Impacts:

The implications of such a vulnerability are manifold, ranging from data breaches to loss of user trust and potential harm to a site's reputation. In a digital ecosystem where integrity and trust are paramount, vulnerabilities like CVE-2024-2475 represent not just a technical flaw, but a breach in the digital contract between a site and its users.

Mitigating the Threat:

In response to this vulnerability, the release of version 3.14 stands as a bulwark against potential exploits, patching the security flaw and restoring integrity to affected installations. Users are urged to update their Media Library Assistant plugin to this version immediately, reinforcing their site's defenses against this and similar threats.

Historical Context:

This is not the plugin's first encounter with vulnerability; with 11 previous issues reported since May 2018, the security landscape of Media Library Assistant reflects the ongoing challenges faced by digital tools in maintaining a secure environment.

The Imperative of Digital Vigilance:

For small business owners, the digital aspect of their enterprise is often intertwined with their brand identity, making web security not just a technical issue, but a foundational business concern. The story of Media Library Assistant's vulnerability is a potent reminder of the dynamic nature of web security and the need for constant vigilance. Staying informed about potential vulnerabilities, ensuring regular updates, and adopting a proactive stance towards digital security are essential practices in safeguarding the digital frontiers of today's businesses. In an era where the digital presence is inextricably linked to business success, the importance of securing WordPress installations cannot be overstated, forming a critical component of a business's digital strategy and its contract of trust with its users.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Media Library Assistant Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode – CVE-2024-2475 |WordPress Plugin Vulnerability Report FAQs

Leave a Comment