Zephyr Project Manager < 3.2.55 - Unauthorised AJAX Calls To Stored XSS
Priority LOW 25CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering, Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352 and CWE-79.
Summary
The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them to perform Stored Cross-Site Scripting attacks against logged in admins.
Why it matters now
EPSS 0.00473 41st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Zephyr Project Manager (Unknown): 3.2.55
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Zephyr Project Manager | 3.2.55 to before 3.2.55 | 3.2.55 | Patch available | CNA |
- Zephyr Project Manager VendorUnknown Affected 3.2.55 to before 3.2.55 Fixed in 3.2.55 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zephyr-one:zephyr_project_manager:*:*:*:*:*:wordpress:*:* | before 3.2.55 | Vulnerable | Zephyr-one |
- cpe:2.3:a:zephyr-one:zephyr_project_manager:*:*:*:*:*:wordpress:*:* Versions before 3.2.55 Vulnerable ·Zephyr-one
Remediation
- Fix · CNA Zephyr Project Manager (Unknown) Fixed in 3.2.55
Timeline
- 2026-10-02 Threatist record created from CVE-2022-2839
- 2026-10-03 Alias added: GHSA-p2c9-6h79-p9j6
References
More Zephyr-one Zephyr Project Manager vulnerabilities
- TI-2022-03080 Zephyr Project Manager REST Call cross site scripting CVSS 3.1MEDIUM 5.4
- TI-2022-02633 Zephyr Project Manager < 3.2.5 - Multiple Unauthenticated SQLi CVSS 3.1CRITICAL 9.8
- TI-2024-28974 WordPress Zephyr Project Manager plugin <= 3.3.100 - Insecure Direct Object References (IDOR) vulnerability CVSS 3.1CRITICAL 9.8
- TI-2024-24988 WordPress Zephyr Project Manager plugin <= 3.3.97 - Privilege Escalation vulnerability CVSS 3.1HIGH 8.8
- TI-2024-25995 WordPress Zephyr Project Manager plugin <= 3.3.99 - Sensitive Data Exposure via Export File vulnerability CVSS 3.1HIGH 7.5
- TI-2024-07066 Zephyr Project Manager <= 3.3.101 - Authenticated (Subscriber+) Limited Privilege Escalation CVSS 3.1HIGH 8.1
Sources
- CVE-2022-2839 · CVE Program
- CVE-2022-2839 · NVD
- FIRST EPSS
- GHSA-p2c9-6h79-p9j6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences