CVE-2024-3518

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and including, 3.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: May 22, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-351806.1OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter th CVE-2024-351818.1Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. CVE-2024-351828.1Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. CVE-2024-351834.4wolfictl is a command line tool for working with Wolfi. A git authentication issue in versions prior to 0.16.10 allows a local user’s GitHub CVE-2024-351845.5Paperless-ngx is a document management system that transforms physical documents into a searchable online archive. Starting in version 2.5.0 CVE-2024-351855.3Minder is a software supply chain security platform. Prior to version 0.0.49, the Minder REST ingester is vulnerable to a denial of service CVE-2024-351868.8gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the wo CVE-2024-351879.1Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, attackers who achieved Arbitrary Code Execution as the stalwart-CVE-2024-351896.5Fides is an open-source privacy engineering platform. The Fides webserver has a number of endpoints that retrieve `ConnectionConfiguration` CVE-2024-35196.1The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the lang parameter in all versions up t CVE-2024-351905.3Asterisk is an open source private branch exchange and telephony toolkit. After upgrade to 18.23.0, ALL unauthorized SIP requests are identi CVE-2024-351914.4Formie is a Craft CMS plugin for creating forms. Prior to 2.1.6, users with access to a form's settings can include malicious Twig code into