Media Library Assistant

84 Quality Score

Active Installs

22/30

70,000 active installs is solid for a specialized media management tool, though it sits well below mass-market plugins like Autoptimize or Safe SVG in raw reach.

Update Freshness

25/25

A recent update in July 2026 and clean version tracking suggest the developer is actively maintaining the codebase.

User Rating

14/15

A 96 out of 100 rating across 201 reviews indicates exceptionally high user satisfaction for a feature-rich utility plugin.

Support Health

8/15

Only 7 total support threads with 6 resolved is a high resolution rate, though the very low thread volume makes it hard to judge responsiveness under heavier load.

WP Compatibility

15/15

Tested up to WordPress 7.0.1 and requiring PHP 7.4, the plugin meets or exceeds current WordPress and PHP baseline requirements.

Scores higher than 93% of indexed plugins

About

Enhances the Media Library; powerful gallery and list shortcodes, full taxonomy support, IPTC/EXIF/XMP/PDF processing, bulk/quick edit.

Active Installs 70k+

Rating ★★★★½ 4.8/5

Last Updated 2026-09-27 1:49am GMT

Requires WordPress 5.3.0+

Tested Up To 7.1.2

Requires PHP 7.4+

Security History

40 known vulnerabilities, all patched

2 Critical 9 High 29 Medium

Most recent: September 10, 2026

View details ▸

Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter Medium

September 10, 2026 Patched in ["3.36"] CVE-2026-6641

Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import Medium

September 10, 2026 Patched in ["3.36"] CVE-2026-6642

Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter Medium

September 10, 2026 Patched in ["3.36"] CVE-2026-6640

Media Library Assistant < 3.40 - Authenticated (Author+) SQL Injection Medium

August 24, 2026 Patched in ["3.40"] CVE-2026-16959

Media Library Assistant <= 3.39 - Authenticated (Author+) Arbitrary File Upload High

August 19, 2026 Patched in ["3.40"] CVE-2026-66600

Media Library Assistant <= 3.39 - Authenticated (Subscriber+) Stored Cross-Site Scripting Medium

August 19, 2026 Patched in ["3.40"] CVE-2026-66601

Media Library Assistant <= 3.39 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

August 18, 2026 Patched in ["3.40"] CVE-2026-66591

Media Library Assistant <= 3.38 - Unauthenticated Stored Cross-Site Scripting High

August 4, 2026 Patched in ["3.39"] CVE-2026-61963

Media Library Assistant <= 3.35 - Authenticated (Contributor+) SQL Injection Medium

June 18, 2026 Patched in ["3.36"] CVE-2026-56012

Media Library Assistant <= 3.35 - Reflected Cross-Site Scripting Medium

June 15, 2026 Patched in ["3.36"] CVE-2026-54198

Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form High

May 28, 2026 Patched in ["3.36"] CVE-2026-6075

Media Library Assistant <= 3.34 - Authenticated (Contributor+) SQL Injection Medium

April 6, 2026 Patched in ["3.35"] CVE-2026-34885

Media Library Assistant <= 3.34 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

April 6, 2026 Patched in ["3.35"] CVE-2026-34897

Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification Medium

March 4, 2026 Patched in ["3.34"] CVE-2026-3072

Media LIbrary Assistant <= 3.32 - Authenticated (Contributor+) SQL Injection Medium

February 20, 2026 Patched in ["3.33"] CVE-2026-32399

Media Library Assistant <= 3.29 - Unauthenticated Limited File Read Medium

October 17, 2025 Patched in ["3.30"] CVE-2025-11738

Media Library Assistant <= 3.29 - Missing Authorization Medium

October 9, 2025 Patched in ["3.30"] CVE-2025-63065

Media Library Assistant <= 3.28 - Authenticated (Author+) Stored Cross-Site Scripting Medium

September 22, 2025 Patched in ["3.29"] CVE-2025-59590

Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion Medium

August 18, 2025 Patched in ["3.28"] CVE-2025-8357

Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes Medium

July 15, 2025 Patched in ["3.27"] CVE-2025-7035

Media Library Assistant <= 3.24 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

March 31, 2025 Patched in ["3.25"] CVE-2025-31627

Media Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters Medium

January 3, 2025 Patched in ["3.24"] CVE-2024-11974

Media Library Assistant <= 3.19 - Authenticated (Administrator+) Remote Code Execution High

November 1, 2024 Patched in ["3.20"] CVE-2024-51661

Media Library Assistant <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action High

August 12, 2024 Patched in ["3.19"] CVE-2024-6823

Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting Medium

July 1, 2024 Patched in ["3.18"] CVE-2024-5544

Media Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameter High

June 19, 2024 Patched in ["3.17"] CVE-2024-5605

Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang Medium

May 21, 2024 Patched in ["3.16"] CVE-2024-3519

Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode High

May 21, 2024 Patched in ["3.16"] CVE-2024-3518

Media Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode Medium

March 28, 2024 Patched in ["3.14"] CVE-2024-2475

Media Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcode Medium

March 25, 2024 Patched in ["3.14"] CVE-2024-2871

Media Library Assistant <= 3.11 - Authenticated (Author+) Stored Cross-Site Scripting Medium

October 2, 2023 Patched in ["3.12"] CVE-2023-24385

Media Library Assistant <= 3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Medium

September 21, 2023 Patched in ["3.11"] CVE-2023-4716

Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution Critical

September 5, 2023 Patched in ["3.10"] CVE-2023-4634

Media Library Assistant <= 3.07 - Reflected Cross-Site Scripting Medium

July 12, 2023 Patched in ["3.0.8"] CVE-2023-34010

Media Library Assistant <= 3.05 - Authenticated (Administrator+) SQL Injection High

February 16, 2023 Patched in ["3.06"] CVE-2023-0279

Media Library Assistant <= 3.00 - Information Disclosure Medium

September 29, 2022 Patched in ["3.01"] CVE-2022-41618

Media Library Assistant <= 2.81 - Remote Code Execution via tax_query, meta_query, date_query Parameters Critical

December 15, 2019 Patched in ["2.82"] CVE-2020-11928

Media Library Assistant <= 2.81 - Authenticated Cross-Site Scripting Medium

December 15, 2019 Patched in ["2.82"] CVE-2020-11731

Media Library Assistant <= 2.81 - Local File Inclusion High

December 15, 2019 Patched in ["2.82"] CVE-2020-11732

Media Library Assistant <= 2.73 - Cross-Site Scripting Medium

May 28, 2018 Patched in ["2.74"] CVE-2018-20982

What It Does

Media Library Assistant extends the default WordPress Media Library by adding full taxonomy support (categories, tags, and custom terms) so every image, video, audio file, or PDF can be organized and queried like a post. It ships with gallery and list shortcodes, IPTC, EXIF, XMP, and PDF metadata extraction, plus bulk and quick edit screens for managing large libraries efficiently.

Who It's For

This plugin is built for publishers, photographers, news outlets, stock content sites, and any WordPress user managing hundreds or thousands of media files who need real taxonomy, metadata, and shortcode-driven display rather than the flat folder structure WordPress ships with. It is especially useful for sites that rely on PDF archives, image-heavy editorial workflows, or custom media-driven templates.

Who Should Skip It

If your site only handles a handful of images and you never organize media beyond the default uploader, this plugin is overkill and adds interface complexity you do not need. Users wanting a simple folder-based UI should consider FileBird or Folders instead.

The Bottom Line

Media Library Assistant is a mature, well-loved plugin that delivers something WordPress core still lacks: true taxonomy and metadata handling for media files. It earns its 83.6 overall score through strong maintenance and ratings, and it is the right pick for media-heavy sites that have outgrown the default library. Smaller sites or those wanting only folder views will find simpler alternatives a better fit.

Related Plugins

Safe SVG 89/100

Pick Safe SVG if your primary need is allowing and sanitizing SVG uploads rather than organizing existing media.

Autoptimize 88/100

Pick Autoptimize if you want front-end performance optimization like CSS, JS, and font aggregation rather than media library organization.

FileBird – WordPress Media Library Folders & File Manager 85/100

Pick FileBird if you want a familiar visual folder structure inside the Media Library and do not need taxonomy or metadata extraction.

WebP Express 85/100

Pick WebP Express if your priority is serving next-generation image formats for performance, not tagging or shortcoding media.

Folders – Unlimited Folders to Organize Media Library 85/100

Pick Folders if you want lightweight folder organization across media, pages, and posts without MLA's deeper taxonomy machinery.