Reflected Cross-Site Scripting Vulnerability in Attachments Handler for WordPress

CVE-2025-12581

What is CVE-2025-12581?

The Attachments Handler plugin for WordPress is susceptible to Reflected Cross-Site Scripting (XSS), which arises from inadequate input sanitization and output escaping practices. This vulnerability allows unauthenticated users to inject malicious scripts into pages, potentially manipulating users into executing these scripts by clicking on compromised links. It is crucial for users running this plugin on their WordPress sites to apply security patches or updates to safeguard against potential exploitation.

References