The Auto Attachments plugin contains a stored cross‑site scripting flaw that arises from insufficient input sanitization and output escaping in its admin settings. An attacker who has administrator‑level permissions can inject arbitrary JavaScript that, once saved, will run in the browsers of any user who views the affected page. The vulnerability permits client‑side code execution but does not provide direct server‑side access.

The flaw affects the Auto Attachments plugin from kaisercrazy in all releases up to and including version 1.8.5. It is relevant only on WordPress multisite installations or sites where the unfiltered_html filter is disabled, and only accounts with administrator or higher privileges can perform the exploit.

The CVSS score of 5.5 indicates moderate severity, and its EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the WordPress admin interface; the attacker modifies plugin settings to insert the payload, which is then executed when any visitor loads the page.