Dylanjkotze Zephyr Project Manager vulnerabilities

CVE-2024-7624 [HIGH] CWE-285 CVE-2024-7624: The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 3.3.101. This is due to the plugin not properly checking a users capabilities before allowing them to enable access to the plugin's settings through the update_user_access() function. This makes it possible for authenticate

CVE-2024-43916 [HIGH] CWE-639 CVE-2024-43916: Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.102.

CVE-2025-12496 [MEDIUM] CWE-22 CVE-2025-12496: The Zephyr Project Manager plugin for WordPress is vulnerable to Directory Traversal in all versions The Zephyr Project Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.203 via the `file` parameter. This makes it possible for authenticated attackers, with Custom-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. On a server

CVE-2024-6536 [MEDIUM] CWE-79 CVE-2024-6536: The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its s The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors and admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVE-2024-7356 [MEDIUM] CWE-79 CVE-2024-7356: The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘filename’ parameter in all versions up to, and including, 3.3.100 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in

CVE-2022-1822 [MEDIUM] CWE-79 CVE-2022-1822: The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘project’ parameter in versions up to, and including, 3.2.40 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfull

CVE-2025-10490 [MEDIUM] CWE-79 CVE-2025-10490: The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via adm The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.3.202 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in