Skip to content
PluginCanary

Media Library Assistant

by David Lingren · 70,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 28 Oct 2026, 24 releases in 24 months, no unpatched vulnerabilities.

86/ 100 Canary Score
Sub-scores for Media Library Assistant
Ownership100
Maintenance100
Security60
Support88
Reputation85

How the score works

Quick answers

Is Media Library Assistant still maintained?
Yes. Last release 28 Oct 2026, 24 releases in the last 24 months. 28 Oct 2026 · wordpress.org
Who owns Media Library Assistant, and has it changed hands?
No change recorded. Main committer dglingren since Aug 2012. 4 Nov 2026 · SVN log
Was Media Library Assistant removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Media Library Assistant safe?
51 known vulnerabilities, all fixed (latest in 3.44). Not on the exploited list. 30 Oct 2026 · Wordfence Intelligence
Is the latest Media Library Assistant update safe to install?
No ownership change before 3.44. No one-star spike after it. 28 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
dglingren13 Aug 2012 to 31 Oct 2026, 886 commits

1 committer recorded. No ownership change since 2012.

Maintenance

Last release
6 days ago
Releases, 24 months
24
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for Media Library Assistant
Q1 20240
Q2 20243
Q3 20243
Q4 20244
Q1 20250
Q2 20252
Q3 20253
Q4 20251
Q1 20265
Q2 20263
Q3 20264
Q4 20262

Last release 28 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 5.0 (1 review). Lifetime: 4.8.

Average rating per quarter for Media Library Assistant
Q1 20245.0
Q3 20245.0
Q4 20245.0
Q2 20255.0
Q3 20255.0
Q4 20251.0
Q1 20265.0
Q2 20263.7
Q3 20265.0

Average rating stayed at 5.0 between Q1 2024 and Q3 2026.

Rating distribution
5 star185
4 star8
3 star2
2 star1
1 star6
Latest low reviews

Security record

33 vulnerabilities in 24 months (51 on record), all patched (latest fixed in 3.44).

Show 51 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
30 Oct 2026Media Library Assistant <= 3.43 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 3.433.44Patched before disclosure
30 Oct 2026Media Library Assistant <= 3.43 - Missing Authorization4.3<= 3.433.44Patched before disclosure
28 Oct 2026Media Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links4.7<= 3.423.43Patched before disclosure
28 Oct 2026Media Library Assistant < 3.42 - Cross-Site Request Forgery4.3< 3.423.42Patched before disclosure
26 Oct 2026Media Library Assistant <= 3.42 - Authenticated (Contributor+) Information Exposure4.3<= 3.423.43Patched before disclosure
26 Oct 2026Media Library Assistant <= 3.42 - Authenticated (Author+) SQL Injection6.5<= 3.423.43Patched before disclosure
26 Oct 2026Media Library Assistant <= 3.42 - Cross-Site Request Forgery4.3<= 3.423.43Patched before disclosure
26 Oct 2026Media Library Assistant < 3.42 - Cross-Site Request Forgery4.3< 3.423.42Patched before disclosure
7 Oct 2026Media Library Assistant <= 3.41 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 3.413.42Patched before disclosure
3 Oct 2026Media Library Assistant <= 3.41 - Unauthenticated Stored Cross-Site Scripting7.2<= 3.413.42Patched before disclosure
30 Sep 2026Media Library Assistant <= 3.41 - Authenticated (Contributor+) SQL Injection6.5<= 3.413.42Patched before disclosure
10 Sep 2026Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import6.4<= 3.353.36Patched before disclosure
10 Sep 2026Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter6.4<= 3.353.36Patched before disclosure
10 Sep 2026Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter6.4<= 3.353.36Patched before disclosure
24 Aug 2026Media Library Assistant < 3.40 - Authenticated (Author+) SQL Injection6.5< 3.403.40Patched before disclosure
19 Aug 2026Media Library Assistant <= 3.39 - Authenticated (Author+) Arbitrary File Upload8.8<= 3.393.40Patched before disclosure
19 Aug 2026Media Library Assistant <= 3.39 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4<= 3.393.40Patched before disclosure
18 Aug 2026Media Library Assistant <= 3.39 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 3.393.40Patched before disclosure
4 Aug 2026Media Library Assistant <= 3.38 - Unauthenticated Stored Cross-Site Scripting7.2<= 3.383.39Patched before disclosure
18 Jun 2026Media Library Assistant <= 3.35 - Authenticated (Contributor+) SQL Injection6.5<= 3.353.36Patched before disclosure
15 Jun 2026Media Library Assistant <= 3.35 - Reflected Cross-Site Scripting6.1<= 3.353.36Patched before disclosure
28 May 2026Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form8.1<= 3.353.36Patched before disclosure
6 Apr 2026Media Library Assistant <= 3.34 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 3.343.35Patched before disclosure
6 Apr 2026Media Library Assistant <= 3.34 - Authenticated (Contributor+) SQL Injection6.5<= 3.343.35Patched before disclosure
4 Mar 2026Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification4.3<= 3.333.342

Changelog mentions of security fixes: 3.36 (security, SQL injection); 3.37 (security, SQL injection); 3.39 (security); 3.40 (security, SQL injection); 3.41 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

88% of 8 support threads resolved in the last 2 months.

Momentum

70,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Media Library Assistant
4 May 20261,128
11 May 20262,011
18 May 202621,302
25 May 202626,246
1 Jun 20266,473
8 Jun 202624,003
15 Jun 20264,421
22 Jun 20263,031
29 Jun 20262,724
6 Jul 202619,660
13 Jul 202610,529
20 Jul 20264,216
27 Jul 20263,201
3 Aug 20263,841
10 Aug 20262,317
17 Aug 202626,473
24 Aug 20265,045
31 Aug 20263,314
7 Sep 202623,403
14 Sep 20266,775
21 Sep 202618,572
28 Sep 202610,656
5 Oct 20267,370
12 Oct 20262,944
19 Oct 202623,375
26 Oct 202632,293
2 Nov 20261,909

Weekly downloads over the last 4 weeks are 37% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

reGenerate Thumbnails AdvancedScore 100 · 60,000+File Upload Types by WPFormsScore 100 · 40,000+WP SVG ImagesScore 100 · 30,000+Media Library CategoriesScore 100 · 20,000+No Right Click ImagesScore 100 · 20,000+

Facts

Version3.44
AuthorDavid Lingren
Added13 Aug 2012
Last updated28 Oct 2026
Active installs70,000+
Requires WordPress5.3.0
Tested up to7.1.4
Requires PHP7.4
CategoryContent Management > Media Library & Asset Management
Tagstags, media, images, categories, media library

Other plugins by this author: Media Library Assistant Blocks

Questions

Is Media Library Assistant still maintained?

Yes. Last release 28 Oct 2026, 24 releases in the last 24 months.

Who owns Media Library Assistant, and has it changed hands?

No change recorded. Main committer dglingren since Aug 2012.

Was Media Library Assistant removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Media Library Assistant safe?

51 known vulnerabilities, all fixed (latest in 3.44). Not on the exploited list.

Is the latest Media Library Assistant update safe to install?

No ownership change before 3.44. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue