The WP Attachments plugin for WordPress is vulnerable in all versions up to 5.0.12 because the attachment_id parameter is not properly sanitized or escaped, which allows unauthenticated attackers to inject JavaScript that is reflected in the page. This reflected cross‑site scripting can execute malicious scripts in a victim's browser when a crafted link containing the vulnerable parameter is opened, potentially allowing an attacker to run arbitrary code within the context of the site.

The affected product is the WP Attachments plugin from milmor. All releases up to and including version 5.0.12 are impacted. No other vendors are mentioned in the data.

The CVSS score of 6.1 indicates moderate severity. The EPSS score of less than 1% suggests a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, meaning it has not been widely exploited. Based on the description, the likely attack vector is unauthenticated via a malicious URL that includes an unsanitized attachment_id parameter, which triggers the script when the victim follows the link.