Custom Post Type Attachment
Custom Post Type Attachment has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; 1 is fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).
1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.
2 independent researchers contributed these findings, one record each. Custom Post Type Attachment is installed on roughly 700 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.
CVE-2025-62907Custom Post Type Attachment <= 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Custom Post Type Attachment
Author
aviplugins.com
This plugin will allow you to upload files to your post or pages or any other custom post types. You can eather use shortcodes or functions to display attachments. just install the plugin and update setting from Settings-> Custom Post Type Attachment. Upload files in your post/page edit page. Display files in frontend using shortcodes or using custom functions. Usage Display all attachments with a single shortcode [pdf_all_attachments] Display Single attachment [pdf_attachment file=”file_number” name=”optional file_name”] Example: [pdf_attachment file=”1″ name=”PDF File 1″] Or pdf_attachment_file(“file_number”,”optional file_name”); Example: <?php echo pdf_attachment_file("1","PDF File 1"); ?> Custom Post Type Attachment PRO There is a PRO version of this plugin that supports unlimited files to upload with multiple file types. You can get it here in USD 1.50 Attachment number can be Increased / Decreased from the post edit page. You can upload other type of files also. Supported files that can be uploaded are PDF, TXT, JPG, JPEG, BMP, GIF, PNG, DOC, DOCX, XLS, CSV, PPT, PPTX, ZIP. Every file can be marked as Hidden. These files will be hidden from visitors of the site. Only Logged In users will be able to download these files. For others a message will be displayed in place of the hidden files. This message can be updated from admin panel. You can select the user types that you want to give Permission to be able download the attachment files. Only selected user types will have permission to download the attachments. More Advanced File Download feature. Users can be asked to enter basic details like Name, Email & Phone Number before they can download the Attachments. Files Attachment option can be enabled in the WordPress default comments section as well. Files can be embedded in the page content. Users can view the content of the file before download. Supported document files that can be embedded are Adobe Acrobat (PDF), Microsoft Word (DOC), Microsoft PowerPoint (PPT), Microsoft Excel (XLS) Click here to find out in details Post your plugin related queries at https://www.aviplugins.com/support.php
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C