CVE-2024-8673

The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
WPScanCNA
---
---
CISA-ADPADP
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 91%
VendorProductVersion
urbanbasez-downloads
𝑥
< 1.11.7
𝑥
= Vulnerable software versions
References
https://wpscan.com/vulnerability/fed2cd26-7ccb-419d-b589-978410953bf4/
https://wpscan.com/vulnerability/fed2cd26-7ccb-419d-b589-978410953bf4/