TI-2022-03080 CVE-2022-3333 · GHSA-2prc-g792-pf54
Zephyr Project Manager REST Call cross site scripting
Priority MEDIUM 58
A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4.
Zephyr-one
Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
Zephyr-one records in CISA KEVNo Zephyr-one vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
10 records
TI-2022-02633 CVE-2022-2840 · GHSA-v5j7-5w29-28r9
Zephyr Project Manager < 3.2.5 - Multiple Unauthenticated SQLi
Priority MEDIUM 57
The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated us…
TI-2024-28974 CVE-2024-43322 · GHSA-3gqh-c39x-hvhh
WordPress Zephyr Project Manager plugin <= 3.3.100 - Insecure Direct Object References (IDOR) vulnerability
Priority MEDIUM 42
Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.100.
TI-2024-24988 CVE-2024-37484 · GHSA-7fw5-3r82-477f
WordPress Zephyr Project Manager plugin <= 3.3.97 - Privilege Escalation vulnerability
Priority MEDIUM 40
Improper Privilege Management vulnerability in Dylan James Zephyr Project Manager allows Privilege Escalation.This issue affects Zephyr Project Manager: from n/a through 3.3.97.
TI-2024-25995 CVE-2024-38761 · GHSA-4g7c-qjqw-rvrq
WordPress Zephyr Project Manager plugin <= 3.3.99 - Sensitive Data Exposure via Export File vulnerability
Priority LOW 39
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.99.
TI-2024-07066 CVE-2024-7624 · GHSA-c9xj-qgpm-mj78
Zephyr Project Manager <= 3.3.101 - Authenticated (Subscriber+) Limited Privilege Escalation
Priority LOW 37
The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 3.3.101.
TI-2025-23591 CVE-2025-32526 · GHSA-qg7m-x7h8-fwj3
WordPress Zephyr Project Manager plugin <= 3.3.101 - Cross Site Scripting (XSS) vulnerability
Priority LOW 31
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Reflected XSS.This issue affects Zephyr Project Manag…
TI-2024-06817 CVE-2024-7356 · GHSA-2g64-p9rr-cp7f
Zephyr Project Manager <= 3.3.100 - Authenticated (Subscriber+) Stored Cross-Site Scripting via filename Parameter
Priority LOW 30
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘filename’ parameter in all versions up to, and including, 3.3.100 due to insufficient input sanitization and output es…
TI-2022-02632 CVE-2022-2839 · GHSA-p2c9-6h79-p9j6
Zephyr Project Manager < 3.2.55 - Unauthorised AJAX Calls To Stored XSS
Priority LOW 25
The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated users to call them either directly or via CSRF attacks.
TI-2024-29504 CVE-2024-43915 · GHSA-87jf-8g46-rh2g
WordPress Zephyr Project Manager plugin <=3.3.102 - Cross Site Scripting (XSS) vulnerability
Priority LOW 24
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dylan James Zephyr Project Manager allows Reflected XSS.This issue affects Zephyr Project Manager: from n/a thr…