Custom Post Type Attachment
Avoid: vulnerability published 29 Sep 2025 still has no fix after 14 days.
Capped at 39: a vulnerability has no patch.
| Ownership | 100 |
|---|---|
| Maintenance | 20 |
| Security | 25 |
| Support | No data |
| Reputation | No data |
Quick answers
- Is Custom Post Type Attachment still maintained?
- No. Last release 31 Dec 2024, over 1 year ago. 31 Dec 2024 · wordpress.org
- Who owns Custom Post Type Attachment, and has it changed hands?
- No change recorded. Main committer avi.megladon since Feb 2014. 3 Nov 2026 · SVN log
- Was Custom Post Type Attachment removed from wordpress.org?
- No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
- Is Custom Post Type Attachment safe?
- No. 1 known vulnerability has no fix in the current version. 29 Sep 2025 · Wordfence Intelligence
- Is the latest Custom Post Type Attachment update safe to install?
- No ownership change before 3.4.6. No one-star spike after it. 15 May 2024 · Release history
Active signals
Facts we detected, with links to the source.
- CriticalSEC-2Vulnerability published 29 Sep 2025 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.13 Oct 2025Evidence
- WarningMNT-2Tested up to WordPress 6.7.11, 4 major versions behind 7.1.4. Plan a replacement if the plugin is important to your site.3 Nov 2026Evidence
- WarningMNT-1No release in 22 months (last release 31 Dec 2024). Plan a replacement if the plugin is important to your site.31 Dec 2025Evidence
Ownership timeline
Who commits to the plugin's code on wordpress.org, over time.
| avi.megladon | 24 Feb 2014 to 31 Dec 2024, 97 commits |
|---|
1 committer recorded. No ownership change since 2014.
Maintenance
- Last release
- 22 months ago
- Releases, 24 months
- 0
- Tested up to
- 6.7 vs 7.1
- Requires PHP
- not stated supported 8.2+
| Q1 2024 | 0 |
|---|---|
| Q2 2024 | 1 |
| Q3 2024 | 0 |
| Q4 2024 | 0 |
| Q1 2025 | 0 |
| Q2 2025 | 0 |
| Q3 2025 | 0 |
| Q4 2025 | 0 |
| Q1 2026 | 0 |
| Q2 2026 | 0 |
| Q3 2026 | 0 |
| Q4 2026 | 0 |
Last release 31 Dec 2024. Tested up to 6.7, 4 major versions behind WordPress 7.1.
Reputation
Last 90 days: no reviews. Lifetime: 5.0.
| 5 star | 3 |
|---|---|
| 4 star | 0 |
| 3 star | 0 |
| 2 star | 0 |
| 1 star | 0 |
Security record
1 vulnerability in 24 months (2 on record), 1 with no fix in the current version.
| Published | Issue | CVSS | Affected | Fixed in | Days to patch |
|---|---|---|---|---|---|
| 29 Sep 2025 | Custom Post Type Attachment <= 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting | 6.4 | <= 3.4.6 | No fix | n/a |
Show 1 patched vulnerability
| Published | Issue | CVSS | Affected | Fixed in | Days to patch |
|---|---|---|---|---|---|
| 15 May 2024 | Custom Post Type Attachment <= 3.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via pdf_attachment Shortcode | 6.4 | <= 3.4.5 | 3.4.6 | 230 |
Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.
Support
Support history appears after our first snapshots of the forum counts.
Momentum
700+ active installs. History builds with each weekly snapshot.
Momentum history builds with each snapshot.
Healthier alternatives
Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.
No healthier plugin in the same category yet.
Facts
| Version | 3.4.6 |
|---|---|
| Author | aviplugins.com |
| Added | 24 Feb 2014 |
| Last updated | 31 Dec 2024 |
| Active installs | 700+ |
| Requires WordPress | 2.0.2 |
| Tested up to | 6.7.11 |
| Requires PHP | not stated |
| Category | Content Management > Document Management & Downloads |
| Tags | file, upload, download, attachment, file attachment |
Other plugins by this author: Login Widget With Shortcode, Thumbnail Editor, WP Register Profile With Shortcode, Webp Converter, Contact Info, WP Support Ticket, WP Easy Poll, WP Booking
Questions
Is Custom Post Type Attachment still maintained?
No. Last release 31 Dec 2024, over 1 year ago.
Who owns Custom Post Type Attachment, and has it changed hands?
No change recorded. Main committer avi.megladon since Feb 2014.
Was Custom Post Type Attachment removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026.
Is Custom Post Type Attachment safe?
No. 1 known vulnerability has no fix in the current version.
Is the latest Custom Post Type Attachment update safe to install?
No ownership change before 3.4.6. No one-star spike after it.