- Puts function parameters into SQL without escaping (code/attachments/public.php line 26, 29)
- Output is not escaped correctly in the settings form, but it uses nonces
- Vulnerable to reflected XSS
- Vulnerable to LFI
This plugin has been given a short, targeted code review.
Before using this plugin, you should very carefully consider its potential problems and should conduct a thorough assessment. Read more about this recommendation.
The version of this plugin that this recommendation was based on is known to be vulnerable to attack:
This recommendation applies to version 2.1 of this plugin, but the most recent version is 2.3.1. These findings may no longer be correct.
Read more about our failure criteria.