Z-Downloads < 1.11.6 - Unauthenticated Stored XSS

Vulnerability

The Z-Downloads WordPress plugin before version 1.11.6 does not sanitize and escape some parameters when outputting them in the page, specifically within share URLs [1]. This allows unauthenticated visitors to inject arbitrary JavaScript code that is stored and executed when the share URL is accessed.

Exploitation

An attacker can craft a malicious share URL containing a JavaScript payload. No authentication is required to create or access such URLs. When an unauthenticated victim visits the crafted URL, the injected script executes in their browser context [1].

Impact

Successful exploitation results in stored Cross-Site Scripting (XSS). The attacker can execute arbitrary JavaScript in the victim's session, potentially leading to cookie theft, page defacement, or redirection to malicious sites.

Mitigation

The vulnerability is fixed in version 1.11.6 of the Z-Downloads plugin [1]. Users should update to this version immediately. No workarounds are documented in the available references.