Media Library Assistant < 3.40 - Author+ SQL Injection via mla_search_connector

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Unknown/Media Library Assistant (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Unknown/Media Library Assistant.
2. 2Review the reported fix. Update Unknown/Media Library Assistant to 3.40 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Aug 21, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Aug 21, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Aug 21, 2026

Sources and claim methodology

• Source referencewpscan.com

Related CVEs

• Link Whisper < 0.9.7 - Editor+ SQL Injection via domain ParameterAlso CWE-89
• SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP submit.php saveUser sql injectionAlso CWE-89
• Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid ParameterSame generic ecosystem
• NewPath WildApricotPress Add-on – Member Directory <= 1.0.0 - Unauthenticated Member PII Disclosure via REST APISame generic ecosystem
• Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag SettingSame generic ecosystem
• Dokan < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST EndpointSame generic ecosystem