CVE-2024-8673

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected software

Vendor	Product	Versions
Unknown	Z-Downloads	< 1.11.7

References

https://wpscan.com/vulnerability/fed2cd26-7ccb-419d-b589-978410953bf4/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/fed2cd26-7ccb-419d-b589-978410953bf4/Exploit, Third Party Advisory

Timeline

Published: May 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-86754.3The Soumettre.fr plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the soumettre_CVE-2024-86767.4A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. CVE-2024-86785.3The Revolut Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec CVE-2024-86796.8The Library Management System – Manage e-Digital Books Library plugin for WordPress is vulnerable to SQL Injection via the ‘value' parameter CVE-2024-86805.5The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up t CVE-2024-86815.4The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Media Grid widget in all CVE-2024-86825.3The JNews - WordPress Newspaper Magazine Blog AMP Theme theme for WordPress is vulnerable to unauthorized user registration in all versions CVE-2024-86848.3OS Command Injection vulnerability in Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH. This vulnerability could allow an auth CVE-2024-86854.3Path-Traversal vulnerability in Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH. This vulnerability could allow an authentica CVE-2024-86867.2A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions CVE-2024-86877.1An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the c CVE-2024-86884.4An improper neutralization of matching symbols vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables authentic