Vulnerabilities and security researches forzephyr-project-manager zephyr-project-manager

Direction: ascending

Jun 07, 2024

Zephyr Project Manager # CVE-2022-3333

CVE, Research URL: CVE-2022-3333
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: Sep 28, 2022
Research Description: A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4. Affected is an unknown function of the file /v1/tasks/create/ of the component REST Call Handler. The manipulation of the argument onanimationstart leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 3.2.5 is able to address this issue. It is recommended to upgrade the affected component. VDB-209370 is the identifier assigned to this vulnerability.
Affected versions: max 3.2.5.
Status: vulnerable

Zephyr Project Manager # CVE-2023-31237

CVE, Research URL: CVE-2023-31237
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: Dec 29, 2023
Research Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.9.
Affected versions: max 3.3.10.
Status: vulnerable

Zephyr Project Manager # CVE-2022-2839

CVE, Research URL: CVE-2022-2839
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: Oct 03, 2022
Research Description: The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them to perform Stored Cross-Site Scripting attacks against logged in admins.
Affected versions: max 3.2.55.
Status: vulnerable

Zephyr Project Manager # CVE-2022-1822

CVE, Research URL: CVE-2022-1822
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: Jun 13, 2022
Research Description: The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘project’ parameter in versions up to, and including, 3.2.40 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions: max 3.2.41.
Status: vulnerable

Zephyr Project Manager # CVE-2022-2840

CVE, Research URL: CVE-2022-2840
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: Sep 19, 2022
Research Description: The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections
Affected versions: max 3.2.5.
Status: vulnerable

Zephyr Project Manager # CVE-2023-34373

CVE, Research URL: CVE-2023-34373
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: Jun 19, 2023
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Project Manager plugin <= 3.3.93 versions.
Affected versions: max 3.3.94.
Status: vulnerable

Jul 08, 2024

Zephyr Project Manager # CVE-2024-37484

CVE, Research URL: CVE-2024-37484
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: Jul 09, 2024
Research Description: Improper Privilege Management vulnerability in Dylan James Zephyr Project Manager allows Privilege Escalation.This issue affects Zephyr Project Manager: from n/a through 3.3.97.
Affected versions: max 3.3.99.
Status: vulnerable

Jul 16, 2024

Zephyr Project Manager # CVE-2024-38761

CVE, Research URL: CVE-2024-38761
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: Aug 02, 2024
Research Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.99.
Affected versions: max 3.3.100.
Status: vulnerable

Aug 01, 2024

Zephyr Project Manager # CVE-2024-6536

CVE, Research URL: CVE-2024-6536
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: Jul 30, 2024
Research Description: The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors and admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Affected versions: max 3.3.99.
Status: vulnerable

Aug 04, 2024

Zephyr Project Manager # CVE-2024-7356

CVE, Research URL: CVE-2024-7356
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: Aug 03, 2024
Research Description: The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘filename’ parameter in all versions up to, and including, 3.3.100 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 3.3.101.
Status: vulnerable

Aug 16, 2024

Zephyr Project Manager # CVE-2024-7624

CVE, Research URL: CVE-2024-7624
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: Aug 15, 2024
Research Description: The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 3.3.101. This is due to the plugin not properly checking a users capabilities before allowing them to enable access to the plugin's settings through the update_user_access() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves full access to the plugin's settings.
Affected versions: max 3.3.102.
Status: vulnerable

Aug 20, 2024

Zephyr Project Manager # CVE-2024-43322

CVE, Research URL: CVE-2024-43322
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: Aug 19, 2024
Research Description: Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.100.
Affected versions: max 3.3.101.
Status: vulnerable

Aug 24, 2024

Zephyr Project Manager # CVE-2024-43915

CVE, Research URL: CVE-2024-43915
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: Aug 27, 2024
Research Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dylan James Zephyr Project Manager allows Reflected XSS.This issue affects Zephyr Project Manager: from n/a through .3.102.
Affected versions: max 3.3.103.
Status: vulnerable

Zephyr Project Manager # CVE-2024-43916

CVE, Research URL: CVE-2024-43916
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: Aug 27, 2024
Research Description: Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.102.
Affected versions: max 3.3.103.
Status: vulnerable

Apr 14, 2025

Zephyr Project Manager # CVE-2025-32526

CVE, Research URL: CVE-2025-32526
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: Apr 17, 2025
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Reflected XSS.This issue affects Zephyr Project Manager: from n/a through <= 3.3.101.
Affected versions: max 3.3.102.
Status: vulnerable

Apr 18, 2025

Zephyr Project Manager # CVE-2025-39552

CVE, Research URL: CVE-2025-39552
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: Apr 16, 2025
Research Description: Missing Authorization vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zephyr Project Manager: from n/a through <= 3.3.200.
Affected versions: max 3.3.201.
Status: vulnerable

Sep 01, 2025

Zephyr Project Manager # CVE-2025-54714

CVE, Research URL: CVE-2025-54714
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: Aug 28, 2025
Research Description: Missing Authorization vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zephyr Project Manager: from n/a through <= 3.3.201.
Affected versions: max 3.3.202.
Status: vulnerable

Nov 10, 2025

Zephyr Project Manager # CVE-2025-10490

CVE, Research URL: CVE-2025-10490
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: Sep 26, 2025
Research Description: The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.3.202 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Affected versions: max 3.3.203.
Status: vulnerable

Jan 10, 2026

Zephyr Project Manager # CVE-2025-12496

CVE, Research URL: CVE-2025-12496
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: Dec 17, 2025
Research Description: The Zephyr Project Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.203 via the `file` parameter. This makes it possible for authenticated attackers, with Custom-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. On a servers that have `allow_url_fopen` enabled, this issue allows for Server-Side Request Forgery
Affected versions: max 3.3.204.
Status: vulnerable

Jun 16, 2026

Zephyr Project Manager # b15c6439e12a306d27288034024f8100bb913121

CVE, Research URL: b15c6439e12a306d27288034024f8100bb913121
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: Aug 29, 2022
Research Description: Zephyr Project Manager [zephyr-project-manager] < 3.2.5 WordPress Zephyr Project Manager plugin <= 3.2.42 - Reflected Cross-Site Scripting (XSS) vulnerability Reflected Cross-Site Scripting (XSS) vulnerability discovered by WPScan in WordPress Zephyr Project Manager plugin (versions <= 3.2.42). Update the WordPress Zephyr Project Manager plugin to the latest available version (at least 3.2.5).
Affected versions: max 3.2.5.
Status: vulnerable

Zephyr Project Manager # d212f4bf8f3932058081ea05860fc6376a03b245

CVE, Research URL: d212f4bf8f3932058081ea05860fc6376a03b245
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: Aug 29, 2022
Research Description: Zephyr Project Manager [zephyr-project-manager] < 3.2.5 Zephyr Project Manager <= 3.2.42 - Reflected Cross-Site Scripting The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.2.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions: max 3.2.5.
Status: vulnerable

Zephyr Project Manager # bfd8a7aa-5977-4fe5-b2fc-12bf93caf3ed

CVE, Research URL: bfd8a7aa-5977-4fe5-b2fc-12bf93caf3ed
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: -
Research Description: Zephyr Project Manager [zephyr-project-manager] < 3.2.5 Zephyr Project Manager < 3.2.5 - Unauthorised REST Calls to Stored XSS The plugin does not have proper authorisation (even when the Require Authorisation for REST API Requests is enabled) in all its REST endpoints, allowing unauthenticated users to call them either directly. Furthermore, due to the lack of sanitisation and escaping, it could also allow them to perform Stored Cross-Site Scripting attacks against logged in admins
Affected versions: max 3.2.5.
Status: vulnerable

Zephyr Project Manager # 2828c20b753453580db85043a8c7e5961c2591d1

CVE, Research URL: 2828c20b753453580db85043a8c7e5961c2591d1
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: Aug 29, 2022
Research Description: Zephyr Project Manager [zephyr-project-manager] < 3.2.5 Zephyr Project Manager <= 3.2.42 - Missing Authorization to Cross-Site Scripting The Zephyr Project Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check and lack of authentication/authorization on its REST endpoints in versions up to, and including, 3.2.42. This makes it possible for unauthenticated attackers to utilize them. Additionally, user input is not properly sanitized leading to Stored Cross-Site Scripting.
Affected versions: max 3.2.5.
Status: vulnerable

Zephyr Project Manager # c20adfc1d187846ec397ff5e47c6c85535b1b51e

CVE, Research URL: c20adfc1d187846ec397ff5e47c6c85535b1b51e
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: Aug 29, 2022
Research Description: Zephyr Project Manager [zephyr-project-manager] < 3.2.5 WordPress Zephyr Project Manager plugin <= 3.2.42 - Unauthorized REST Calls to Stored Cross-Site Scripting (XSS) vulnerability Unauthorized REST Calls to Stored Cross-Site Scripting (XSS) vulnerability discovered by WPScan in WordPress Zephyr Project Manager plugin (versions <= 3.2.42). Update the WordPress Zephyr Project Manager plugin to the latest available version (at least 3.2.5).
Affected versions: max 3.2.5.
Status: vulnerable

Zephyr Project Manager # 96f4ec97-7bdc-4389-8033-5adb8b7d4e83

CVE, Research URL: 96f4ec97-7bdc-4389-8033-5adb8b7d4e83
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: -
Research Description: Zephyr Project Manager [zephyr-project-manager] < 3.2.5 Zephyr Project Manager < 3.2.5 - Reflected Cross-Site Scripting The plugin does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Affected versions: max 3.2.5.
Status: vulnerable

Sep 09, 2026

Zephyr Project Manager # CVE-2026-76931

CVE, Research URL: CVE-2026-76931
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Date: Sep 08, 2026
Research Description: The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability can only be exploited when the 'Directly link to project' plugin setting is disabled.
Affected versions: max 3.3.206.
Status: vulnerable