Z-Downloads
Z-Downloads has 5 disclosed vulnerabilities in the WordSec catalog, all reported in 2024; all 5 are fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 9.1 out of 10. Severity breakdown: 1 critical and 2 high. 2024 was the busiest year with 5 disclosures.
The most common weakness is Cross-Site Scripting, behind 3 of the records (60%). Other recurring categories include Unrestricted Upload Of File With Dangerous Type.
Every one of the 5 issues recorded for Z-Downloads has a vendor fix available, so running the current release closes all known holes.
4 independent researchers contributed these findings, most of them (2) reported by Minh Giang. Z-Downloads is installed on roughly 70 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2024-34555Z-Downloads <= 1.11.3 - Authenticated (Admin+) Arbitrary File Upload
Read the full analysisVulnerability Records
Z-Downloads
Author
URBAN BASE
The convenient download manager for WordPress. Z-Downloads makes file delivery simple: upload, place a shortcode, done. It automatically builds ZIP archives, keeps them updated when files change, and gives you clear stats and a clean UI. Example use case: A single file is present in multiple ZIP archives (e.g., press kits). Update the file once—every affected ZIP is rebuilt automatically. Z-Downloads Website Benefits User-friendly interface with inline help Time-saving automation (auto-rebuild of ZIP archives) Reliable performance with smart caching Top features GDPR compliant: IP address anonymization by default Built-in security: direct file paths remain hidden Download statistics + dashboard widget Shortcodes for files, ZIPs, lists, audio, and video Download button (with optional icons) Display info like file size or download count Generate file lists Embed an audio player Embed a video player Show MD5 and SHA1 hashes in the frontend (Premium) Option to activate direct URL paths for PDF files Centralized file management Automatic ZIP archive creation Drag-and-drop file upload Log page to trace actions and troubleshoot Safe uninstall option to remove all plugin data on request PHP 8 compatible Ready for internationalization (English & German included) Multilingual And more… Effortlessly embed download buttons with shortcodes Upload your file, then add this shortcode to a post or page: [zdownload file="123"] Embed automatically generated ZIP archives with shortcodes Create a ZIP entry in the backend, link your files, then use: [zdownload zip="123"] Embed external files with shortcodes Link to a file hosted elsewhere and render a download button: [zdownload url="https://example.com/file.zip"] Output a list of files linked to a ZIP archive Display all files attached to an archive as a neat list: [zdownload_list zip="123"] Output audio files as an audio player Turn an audio file (MP3, WAV, OGG, …) into a player: [zdownload_audio file="123"] Output video files as a video player Render a video file directly as a player: [zdownload_video file="123"] Languages Z-Downloads can be translated into multiple languages. Currently supported: English German
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C