Read the docs
TI-2026-86493 Aliases CVE-2026-120514GHSA-8949-rwp6-7qwg

Stored cross-site scripting in Zephyr Project Manager for WordPress

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The Zephyr Project Manager plugin for WordPress is affected in all versions up to and including 3.3.209. Missing input sanitization and output escaping of the zpm_profile_picture parameter (CWE-79) lets injected script persist in a user's Zephyr profile. An authenticated attacker with subscriber-level access or higher can plant scripts that run in an administrator's browser when the administrator's autocomplete mention lookup renders the avatar field, and this requires an action by an administrator.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'zpm_profile_picture' parameter in all versions up to, and including, 3.3.209 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the subscriber's own Zephyr profile and fires in any Administrator's browser session the first time the autocomplete mention lookup renders the avatar field, requiring no additional configuration beyond the plugin's default access_roles setting. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00314 24th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dylanjkotzeZephyr Project Managerup to 3.3.209—No fix listedCNA
  • Zephyr Project Manager Vendordylanjkotze Affected up to 3.3.209 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Zephyr Project Manager.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Timeline

  1. 2026-11-07 Threatist record created from CVE-2026-120514
  2. 2026-11-07 Alias added: GHSA-8949-rwp6-7qwg
  3. 2026-11-07 CISA SSVC decision points changed
  4. 2026-11-07 Priority changed: MEDIUM → LOW

References

Other 6

  • TI-2024-06061 Zephyr Project Manager < 3.3.99 - Editor+ XSS CVSS 3.1MEDIUM 5.4
  • TI-2024-07066 Zephyr Project Manager <= 3.3.101 - Authenticated (Subscriber+) Limited Privilege Escalation CVSS 3.1HIGH 8.1
  • TI-2024-29505 WordPress Zephyr Project Manager plugin <= 3.3.102 - Insecure Direct Object References (IDOR) vulnerability CVSS 3.1HIGH 7.1
  • TI-2024-06817 Zephyr Project Manager <= 3.3.100 - Authenticated (Subscriber+) Stored Cross-Site Scripting via filename Parameter CVSS 3.1MEDIUM 6.4
  • TI-2022-01688 Zephyr Project Manager <= 3.2.40 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
  • TI-2026-53747 Zephyr Project Manager <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter CVSS 3.1MEDIUM 6.4
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences