Reflected Cross-Site Scripting Vulnerability in WP Attachments Plugin by WordPress

CVE-2025-5082

What is CVE-2025-5082?

The WP Attachments plugin for WordPress is susceptible to reflected cross-site scripting via the 'attachment_id' parameter in versions up to 5.0.12. This vulnerability arises from inadequate input sanitization and output escaping, enabling potential attackers to execute arbitrary scripts within the context of an authenticated user's session. If an attacker can successfully lure a user into clicking on a specially crafted link, they can exploit this flaw to perform malicious actions on the user's behalf.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References