cleantalk
Vulnerabilities and Security Researches

Z-Downloads, CVE-2024-8699

CVE, Research URL

CVE-2024-8699

Home page URL

Security reports for Z-Downloads

Application

Z-Downloads

Published on
May 16, 2025
Research Description
The Z-Downloads WordPress plugin before 1.11.5 does not properly validate files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
Affected versions
Min -, max 1.11.5.
Status
vulnerable
Previous vulnerability researches
LifterLMS – WordPress LMS Plugin for eLearning (CVE-2024-31363) , Jun 07, 2024
LifterLMS – WordPress LMS Plugin for eLearning (CVE-2019-15896) , Jun 07, 2024
LifterLMS – WordPress LMS Plugin for eLearning (CVE-2021-24562) , Jun 07, 2024
LifterLMS – WordPress LMS Plugin for eLearning (CVE-2021-24308) , Jun 07, 2024
LifterLMS – WordPress LMS Plugin for eLearning (CVE-2020-6008) , Jun 07, 2024
New vulnerability
Widgets Reset (CVE-2024-8082) , May 19, 2025
MapPress Maps for WordPress (CVE-2024-8620) , May 19, 2025
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login (CVE-2024-9390) , May 19, 2025
If-So Dynamic Content Personalization (CVE-2024-5440) , May 19, 2025
Responsive Lightbox & Gallery (CVE-2025-3742) , May 19, 2025