List Related Attachments
List Related Attachments has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for List Related Attachments has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Muhammad Yudha - DJ. List Related Attachments is installed on roughly 90 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 5.1.24.
CVE-2025-26897List Related Attachments <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
List Related Attachments
Author
Baden
List Related Attachments is a sidebar widget and shortcode that will display a filtered, sorted and ordered list of all related attachments linked to current post or page. The widget options are: title, number of attachments to display, type of attachment to display by mime/type, order by value, order direction and what should be displayed (attachment title, caption or description). A complete listing of shortcode options and attribute demos are available that delight and inform. What’s more, there is excellent and free community support and a super-duper online language translation tool to roll-your-own language files.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C