PatchTheCVEz-downloads vulnerabilities and fixes
Recent CVEs affecting z-downloads, with upgrade or downgrade steps. 3 tracked.
Also searched as: z downloads.
z-downloads has 3 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2025-05-15. Highest priority: CVE-2024-8673 (score 61/100).
- CVE-2024-8703 MEDIUM 6.1 UPGRADE The Z-Downloads WordPress plugin before 1.11.6 does not sanitise and escape some parameters when outputting th
- CVE-2024-8699 HIGH 7.2 UPGRADE The Z-Downloads WordPress plugin before 1.11.5 does not properly validate files uploaded, allowing high privil
- CVE-2024-8673 CRITICAL 9.1 UPGRADE The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uplo
FAQ
How do I fix z-downloads vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is z-downloads being exploited right now?
None of the tracked z-downloads CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which z-downloads CVE should I patch first?
CVE-2024-8673 currently ranks highest (61/100): The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uplo.