Live › vulnerability › CVE-2026-97295
Go to dashboardThe Media Library Assistant WordPress plugin by David Lingren has a cross-site request forgery flaw in versions through 3.42. An attacker can trick a logged-in administrator's browser into sending a request the plugin accepts, and the sources do not say which actions that request can perform.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 10:29 UTC. All times on this page are UTC.
Sites running the Media Library Assistant WordPress plugin at version 3.42 or earlier are exposed. Sites without the plugin installed can skip it. The sources do not say whether exploitation requires an authenticated administrator session, so exposure on logged-in admin sessions is unknown.
No product ranges from the sources yet.
wp plugin get media-library-assistant --field=version3.42 or lower3.42 once the vendor publishes one; the sources do not name a fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cross-Site Request Forgery (CSRF) vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Cross Site Request Forgery.This issue affects Media LIbrary Assistant: from n/a through 3.42.
This page as .md · .json · in your agent: get_signal("CVE-2026-97295")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.