CVE-2024-8703: Urbanbase Z-Downloads

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

The Z-Downloads WordPress plugin before 1.11.6 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks when accessing share URLs.

Affected products

• Urbanbase Z-Downloads: before 1.1.16 (fixed in 1.1.16)

Published 2025-05-15. Last modified 2026-06-17.