EUVD-2026-72696
GHSA-9q2r-rq8p-xj26
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS requires a victim to visit the injected page (UI:R); PR:L reflects mandatory Custom-level authentication; S:C and C:L/I:L match cross-user browser-context impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability can only be exploited when the 'Directly link to project' plugin setting is disabled.
AnalysisAI
Stored Cross-Site Scripting in the Zephyr Project Manager WordPress plugin (all versions through 3.3.205) allows authenticated attackers holding Custom-level access or higher to inject persistent JavaScript via the 'message' parameter across three distinct code paths (Projects.php, AjaxHandler.php, Tasks.php). The injected payload executes in the browser of any subsequent user who visits the affected page, enabling session hijacking, credential harvesting, or UI redirection. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two explicit conditions must both be satisfied: (1) the attacker must be authenticated to the WordPress site with at minimum 'Custom-level' plugin access - unauthenticated exploitation is not possible per the PR:L CVSS metric; and (2) the 'Directly link to project' plugin setting must be disabled - the CVE description states exploitation is only possible in this configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 6.4 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) overstates exploitability by scoring UI:N, which is inconsistent with stored XSS where a victim must navigate to the injected page - that constitutes passive user interaction (UI:R in 3.1 terms). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Zephyr Project Manager plugin to the version introduced by WordPress.org changeset 3656930 (https://plugins.trac.wordpress.org/changeset/3656930/); the exact patched release version is not independently confirmed from the available data but should appear as an available update in the WordPress admin dashboard. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Zephyr Project Manager
View allThe Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using th
Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.3.100. Rated critic
The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could
The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJA
A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4. Rated medium seve
Improper Privilege Management vulnerability in Dylan James Zephyr Project Manager allows Privilege Escalation.3.97. Rate
Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Project Manager plugin <= 3.3.93 versions. Rated h
The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Dylan James Zephyr Project Manager.3.99. Rat
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan James Zephyr
Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.3.102. Rated high s
The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘project’ parame
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today