Download Attachments Security Vulnerabilities and Issues — Download Attachments CVE List

Lucene search

DfactoryDownload Attachments

3 matches found

CVE•added 2023/03/06 2:15 p.m.•52 views

CVE-2023-0076

The Download Attachments WordPress plugin before 1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

5.4CVSS5.3AI score0.00103EPSS

CVE•added 2024/06/04 6:15 a.m.•13 views

CVE-2024-3230

The Download Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'download-attachments' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for a...

6.4CVSS5.9AI score0.0022EPSS

CVE•added 2025/06/20 3:15 p.m.•6 views

CVE-2025-49995

Authorization Bypass Through User-Controlled Key vulnerability in dFactory Download Attachments allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Download Attachments: from n/a through 1.3.1.

5.3CVSS5.3AI score0.0004EPSS