WP Attachments
WP Attachments has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2025; all 5 are fixed as of September 2026. Their average CVSS score is 5.1, and the most serious one scores 6.1 out of 10. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 3 of the records (60%). Other recurring categories include Cross-Site Request Forgery (CSRF), Missing Authorization.
Every one of the 5 issues recorded for WP Attachments has a vendor fix available, so running the current release closes all known holes.
5 independent researchers contributed these findings, one record each. WP Attachments is installed on roughly 3,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.2.
CVE-2025-5082WP Attachments <= 5.0.12 - Reflected Cross-Site Scripting via attachment_id Parameter
Read the full analysisVulnerability Records

WP Attachments
Author
Marco Milesi
WP Attachments turns the files you upload to a post into a clean, automatic download list. Attach a file while editing, and it shows up under your content — no manual links, no shortcodes to remember. It also fills the gaps in the WordPress Media Library, letting you attach, unattach and reattach files without leaving the screen you are on. Key features 🤖 Lists attachments automatically after the post content ℹ️ Metabox for managing, previewing, renaming and reordering the files of a post 🔃 Attach, Unattach and Reattach actions in the Media Library 🔢 A Files column in the post and page lists: see the count, click through to the files 🔢 Download counter that ignores crawlers, prefetches and repeat clicks ♿ Reordering works with the mouse, the keyboard and screen readers 🧑💻 Filters for developers who want to change the markup 🛍️ WooCommerce compatible, including High-Performance Order Storage 🎨 Four icon packs for the frontend list 📜 Works with posts, pages and custom post types 🎢 Templates you can customise: title, date, size, caption, downloads and more Video Overview Contributions Part of WPGov.it, providing open source solutions for Italian Public Government websites. Thanks to the Italian community Porte Aperte sul Web for beta testing and ideas. Metabox based on IJ Post Attachments Some icons by Yusuke Kamiyamane.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C