Z Downloads

z-downloads

Vendor: Urbanbase • 3 CVEs

CVEs (3)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-8703 1Urbanbase 1Z Downloads Jun 17, 2026 May 15, 2025 N/A· v4 6.1 MEDIUM· v3 N/A· v2 The Z-Downloads WordPress plugin before 1.11.6 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks when access...Show more The Z-Downloads WordPress plugin before 1.11.6 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks when accessing share URLs.Show less
CVE-2024-8699 1Urbanbase 1Z Downloads Jun 17, 2026 May 15, 2025 N/A· v4 7.2 HIGH· v3 N/A· v2 The Z-Downloads WordPress plugin before 1.11.5 does not properly validate files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for e...Show more The Z-Downloads WordPress plugin before 1.11.5 does not properly validate files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)Show less
CVE-2024-8673 1Urbanbase 1Z Downloads Jun 17, 2026 May 15, 2025 N/A· v4 9.1 CRITICAL· v3 N/A· v2 The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript.