Dfactory Download Attachments vulnerabilities

4 vulnerabilities

Known vulnerabilities in Dfactory Download Attachments, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.3CVE-2025-49995dfactorydownload_attachments+1
EPSS score
0.35%
Authorization Bypass Through User-Controlled Key vulnerability in dFactory Download Attachments download-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Attachments: from n/a through <= 1.3.1.6.4CVE-2024-3230dfactorydownload_attachments+1
EPSS score
0.33%
The Download Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'download-attachments' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.6.5CVE-2026-39616dfactorydownload_attachments+1
EPSS score
0.29%
Authorization Bypass Through User-Controlled Key vulnerability in dFactory Download Attachments download-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Attachments: from n/a through <= 1.4.0.6.4CVE-2023-0076dfactorydownload_attachments+2
EPSS score
0.48%
The Download Attachments WordPress plugin before 1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.