The vulnerability originates from improper neutralization of input when generating a web page, allowing malicious scripts to be stored and later executed in the browsers of any visitor to the affected page. An attacker can inject JavaScript through the plugin’s custom post type feature, leading to potential theft of user credentials, session hijacking, defacement, or phishing attacks delivered from the compromised site.

AviPlugins’ Custom Post Type Attachment plugin, custom-post-type-pdf-attachment, is vulnerable in all releases from the earliest available version up to and including 3.4.6.

With a CVSS score of 6.5, the flaw is considered moderate severity. The EPSS score of less than 1% indicates that at the current time exploitation is unlikely, and the vulnerability is not listed in the CISA KEV catalog. Still, an attacker could exploit the flaw by creating or editing a custom post type or attachment that includes the injected script, which will then be rendered to any user who views that content. The overall risk is moderate, but mitigations should be applied promptly to prevent potential client‑side compromise.