CVE-2025-10490
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.3.202 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Risk Assessment
An attacker with administrator-level permissions can inject malicious scripts that execute in other users' browsers, potentially leading to data theft or account takeover.
Recommendation
Update the Zephyr Project Manager plugin to a version newer than 3.3.202 that includes the fix for this vulnerability.
Other vulnerabilities in Zephyr Project Manager
See all- CVE-2026-76931Medium
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message' parameter in all versions up to and including 3.3.205 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Custom-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page. The vulnerability is only exploitable when the 'Directly link to project' setting is disabled.
- CVE-2025-12496Medium
The Zephyr Project Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.203 via the `file` parameter. This makes it possible for authenticated attackers, with Custom-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. On servers that have `allow_url_fopen` enabled, this issue allows for Server-Side Request Forgery.
Original NVD description (English source)
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.3.202 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS