4212 matches found
CVE-2024-8699
The Z-Downloads WordPress plugin before 1.11.5 does not properly validate files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...
CVE-2024-8673
The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript...
CVE-2024-8031
The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authenticated attackers, with admin-level access and above, to download arbitrary files that may contain sensitive information like wp-config.php...
CVE-2024-8031
The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authenticated attackers, with admin-level access and above, to download arbitrary files that may contain sensitive information like wp-config.php...
CVE-2023-2334 Easy Digital Downloads Google Sheet Connector < 1.6.6 - Access Code Update via CSRF
The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a...
CVE-2023-2334 Easy Digital Downloads Google Sheet Connector < 1.6.6 - Access Code Update via CSRF
The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a...
CVE-2023-2334
CVE-2023-2334 affects the edd-google-sheet-connector-pro WordPress plugin (< 1.4) and the Easy Digital Downloads Google Sheet Connector plugin (
CVE-2024-8703 Z-Downloads < 1.11.6 - Unauthenticated Stored XSS
The Z-Downloads WordPress plugin before 1.11.6 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks when accessing share URLs...
CVE-2024-8703 Z-Downloads < 1.11.6 - Unauthenticated Stored XSS
The Z-Downloads WordPress plugin before 1.11.6 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks when accessing share URLs...
CVE-2024-8703
The CVE reports a stored Cross-Site Scripting vulnerability in the Z-Downloads WordPress plugin prior to version 1.11.6. The root cause is insufficient sanitisation/escaping of certain parameters when they are output on share URLs, enabling unauthenticated users to inject script code. Affected so...
CVE-2024-8699 Z-Downloads < 1.11.5 - Admin+ Arbitrary File Upload
The Z-Downloads WordPress plugin before 1.11.5 does not properly validate files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...
CVE-2024-8673 Z-Downloads < 1.11.7 - Admin+ Stored XSS via SVG Upload
The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript...
CVE-2024-8673 Z-Downloads < 1.11.7 - Admin+ Stored XSS via SVG Upload
The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript...
CVE-2024-8699 Z-Downloads < 1.11.5 - Admin+ Arbitrary File Upload
The Z-Downloads WordPress plugin before 1.11.5 does not properly validate files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...
CVE-2024-8699
The CVE targets the Z-Downloads WordPress plugin prior to version 1.11.5. Affected component: file upload handling in the plugin. Root cause: uploaded files are not properly validated, enabling high-privilege users (e.g., admins) to upload arbitrary files on the server, including in multisite con...
CVE-2024-8031 Secure Downloads < 1.2.3 - Admin+ Arbitrary File Download
The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authenticated attackers, with admin-level access and above, to download arbitrary files that may contain sensitive information like wp-config.php...
CVE-2024-8031 Secure Downloads < 1.2.3 - Admin+ Arbitrary File Download
The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authenticated attackers, with admin-level access and above, to download arbitrary files that may contain sensitive information like wp-config.php...
CVE-2024-8031
The CVE-2024-8031 vulnerability affects the Secure Downloads WordPress plugin (versions before 1.2.3). Root cause: the plugin does not properly restrict which files can be downloaded, enabling authenticated attackers with admin-level access to download arbitrary files (e.g., wp-config.php). Impac...
PT-2025-21507 · WordPress · Secure Downloads
Name of the Vulnerable Software and Affected Versions: Secure Downloads WordPress plugin versions prior to 1.2.3 Description: The issue allows authenticated attackers with admin-level access and above to download arbitrary files, potentially containing sensitive information, such as the...
WordPress plugin Z-Downloads 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...