The Attachments Handler plugin contains a reflected Cross‑Site Scripting vulnerability that is triggered by an attacker‑controlled URL. The flaw stems from insufficient input sanitization and a lack of output escaping, allowing arbitrary scripts to be injected into pages rendered for the victim. If a user is tricked into visiting a crafted link, the script executes in their browser session. Based on typical XSS effects, it could facilitate cookie theft, session hijacking, or malicious site navigation, but the extent depends on the site context.

The vulnerability affects all versions of the kaizencoders Attachments Handler plugin through 1.1.7, which is available on WordPress sites. Users running these versions, especially those that expose the Admin Table interface or provide direct links to attachments, are at risk.

The CVSS score of 6.1 places this flaw in the moderate severity range, and the EPSS score of less than 1 % indicates a low likelihood of exploitation. It is not yet listed in CISA’s KEV catalog. Attackers would need to lure a user to click on a maliciously crafted URL, making social engineering a prerequisite for exploitation. No authentication is required; an unauthenticated user can create the malicious link.