CVE-2024-8673 Z-Downloads < 1.11.7 - Admin+ Stored XSS via SVG Upload

The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript...

CVE-2024-8699

The Z-Downloads WordPress plugin (versions prior to 1.11.5 ) contains a security vulnerability where it fails to properly validate uploaded files. This oversight allows high-privilege users, such as administrators, to upload arbitrary files to the server, even in scenarios where such actions shou...

CVE-2024-8673 Z-Downloads < 1.11.7 - Admin+ Stored XSS via SVG Upload

The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript...

CVE-2024-8699 Z-Downloads < 1.11.5 - Admin+ Arbitrary File Upload

The Z-Downloads WordPress plugin before 1.11.5 does not properly validate files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...

CVE-2024-8699 Z-Downloads < 1.11.5 - Admin+ Arbitrary File Upload

The Z-Downloads WordPress plugin before 1.11.5 does not properly validate files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...

CVE-2024-8031 Secure Downloads < 1.2.3 - Admin+ Arbitrary File Download

The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authenticated attackers, with admin-level access and above, to download arbitrary files that may contain sensitive information like wp-config.php...

CVE-2024-8031

The Secure Downloads WordPress plugin versions prior to 1.2.3 is vulnerable to an arbitrary file download flaw. The root cause is the plugin's failure to properly restrict which files can be downloaded by authenticated users. This allows attackers with admin-level access and above to retrieve arb...

CVE-2024-8031 Secure Downloads < 1.2.3 - Admin+ Arbitrary File Download

The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authenticated attackers, with admin-level access and above, to download arbitrary files that may contain sensitive information like wp-config.php...

PT-2025-21530 · Unknown · Z-Downloads

Name of the Vulnerable Software and Affected Versions: Z-Downloads WordPress plugin versions prior to 1.11.5 Description: The issue allows high privilege users, such as admin, to upload arbitrary files on the server even when they should not be allowed to, for example in a multisite setup. This i...

WordPress plugin Z-Downloads 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2025-21534 · WordPress · Z-Downloads

Name of the Vulnerable Software and Affected Versions: Z-Downloads WordPress plugin versions prior to 1.11.6 Description: The issue arises from the plugin's failure to properly sanitise and escape certain parameters when they are displayed on the page. This oversight could allow unauthenticated...

CVE-2024-8703: Improper Neutralization of Input During Web Page Generation

The Z-Downloads WordPress plugin before 1.11.6 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks when accessing share URLs...

PT-2025-21507 · WordPress · Secure Downloads

Name of the Vulnerable Software and Affected Versions: Secure Downloads WordPress plugin versions prior to 1.2.3 Description: The issue allows authenticated attackers with admin-level access and above to download arbitrary files, potentially containing sensitive information, such as the...

CVE-2024-8673: Undefined Security Weakness

The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript...

CVE-2024-8031: Files or Directories Accessible to External Parties

The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authenticated attackers, with admin-level access and above, to download arbitrary files that may contain sensitive information like wp-config.php...

CVE-2023-2334: Cross-Site Request Forgery (CSRF)

The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a...

CVE-2024-8699: Undefined Security Weakness

The Z-Downloads WordPress plugin before 1.11.5 does not properly validate files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...

WordPress plugin Z-Downloads 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2025-21369 · WordPress · Edd-Google-Sheet-Connector-Pro +1

Name of the Vulnerable Software and Affected Versions: edd-google-sheet-connector-pro WordPress plugin versions prior to 1.4 Easy Digital Downloads Google Sheet Connector WordPress plugin versions prior to 1.6.6 Description: The issue concerns a lack of CSRF check when updating the Access Code,...

PT-2025-21529 · WordPress · Z-Downloads

Name of the Vulnerable Software and Affected Versions: Z-Downloads versions prior to 1.11.7 Description: The issue concerns the Z-Downloads WordPress plugin, which does not properly validate uploaded files. This allows for the uploading of SVG files that contain malicious JavaScript...