Download Attachments Vulnerabilities

The Download Attachments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.0 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform unauthorized actions.

CVSS:

6.5

Affected:

up to 1.4.0

Fixed in:

1.4.1

Disclosed:

Feb 10, 2026

CVE-2026-39616 on NVD →

The Download Attachments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.1 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.3.1

Fixed in:

1.3.2

Disclosed:

Jun 19, 2025

CVE-2025-49995 on NVD →

The Download Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'download-attachments' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

CVSS:

6.4

Affected:

up to 1.3

Fixed in:

1.3.1

Disclosed:

Jun 3, 2024

CVE-2024-3230 on NVD →

The Download Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 1.2.24 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-l...

CVSS:

6.4

Affected:

up to 1.2.24

Fixed in:

1.3

Disclosed:

Feb 13, 2023

CVE-2023-0076 on NVD →