Reflected Cross-Site Scripting Vulnerability in WP Attachments Plugin by WordPress

CVE-2025-5082

What is CVE-2025-5082?

The WP Attachments plugin for WordPress is susceptible to reflected cross-site scripting via the 'attachment_id' parameter in versions up to 5.0.12. This vulnerability arises from inadequate input sanitization and output escaping, enabling potential attackers to execute arbitrary scripts within the context of an authenticated user's session. If an attacker can successfully lure a user into clicking on a specially crafted link, they can exploit this flaw to perform malicious actions on the user's behalf.

References