CVE-2024-8673

EUVD-2025-15229
The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA-ADPADP
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 88%
Affected Products (NVD)
VendorProductVersion
urbanbasez-downloads
𝑥
< 1.11.7
𝑥
= Vulnerable software versions
References
https://wpscan.com/vulnerability/fed2cd26-7ccb-419d-b589-978410953bf4/
https://wpscan.com/vulnerability/fed2cd26-7ccb-419d-b589-978410953bf4/