CVE-2024-8673 - Z-Downloads < 1.11.7 - Admin+ Stored XSS via SVG Upload

Back Back to CVE browser

CRITICAL

Z-Downloads < 1.11.7 - Admin+ Stored XSS via SVG Upload

Published May 15, 2025

9.1

CRITICAL

CVSS 3.1

EPSS 1.79%

Description

The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript.

Affected products

Vendor n/a Product Z-Downloads Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <1.11.7

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Z-Downloads

unaffected

Version	Status	Constraints
0	affected	<1.11.7

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-15229
Advisory
https://wpscan.com/vulnerability/fed2cd26-7ccb-419d-b589-978410953bf4/
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-15229		Advisory
https://wpscan.com/vulnerability/fed2cd26-7ccb-419d-b589-978410953bf4/		exploitvdb-entrytechnical-descriptionThird Party Advisory