Vulnerabilities

TI-2024-29505 CVE-2024-43916 · GHSA-v6fm-w4p3-p8mv

WordPress Zephyr Project Manager plugin <= 3.3.102 - Insecure Direct Object References (IDOR) vulnerability

LOW 31

Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.102.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00321 Published 2024-08-26 No fix listed CWE-639

TI-2024-06061 CVE-2024-6536 · GHSA-f25c-wxgv-xhrw

Zephyr Project Manager < 3.3.99 - Editor+ XSS

MEDIUM 58

The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors and admins to perform Stored Cross-Site Scripting attack…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00774 Published 2024-07-30 Fixed in 3.3.99 CWE-79

Vulnerabilities

Filters

WordPress Zephyr Project Manager plugin <= 3.3.102 - Insecure Direct Object References (IDOR) vulnerability

Zephyr Project Manager < 3.3.99 - Editor+ XSS