Vulnerabilities

TI-2023-14943 CVE-2023-31237 · GHSA-55m9-c43h-qp6x

WordPress Zephyr Project Manager Plugin <= 3.3.9 is vulnerable to Open Redirection

LOW 27

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.9.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00362 Published 2023-12-29 No fix listed CWE-601

TI-2023-17204 CVE-2023-34373 · GHSA-ccx9-5rv5-mwfr

WordPress Zephyr Project Manager Plugin <= 3.3.93 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Project Manager plugin <= 3.3.93 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00248 Published 2023-06-19 No fix listed CWE-352

TI-2022-01688 CVE-2022-1822 · GHSA-wqf2-g6cp-rrpx

Zephyr Project Manager <= 3.2.40 - Reflected Cross-Site Scripting

LOW 29

The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘project’ parameter in versions up to, and including, 3.2.40 due to insufficient input sanitization and output escap…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01113 Published 2022-06-13 No fix listed CWE-79

Vulnerabilities

Filters

WordPress Zephyr Project Manager Plugin <= 3.3.9 is vulnerable to Open Redirection

WordPress Zephyr Project Manager Plugin <= 3.3.93 is vulnerable to Cross Site Request Forgery (CSRF)

Zephyr Project Manager <= 3.2.40 - Reflected Cross-Site Scripting