Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-12-18
CVE-2025-12496 - Zephyr Project Manager Plugin
The Zephyr Project Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.203 via the `file` parameter. This makes it possible for authenticated attackers, with Custom-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. On a servers that have `allow_url_fopen` enabled, this issue allows for Server-Side Request Forgery
PLUGIN
Zephyr Project Manager
CVE-2025-12496
Risk Score
Threat Entry
Updated 2025-09-26
CVE-2025-10490 - Zephyr Project Manager Plugin
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.3.202 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Zephyr Project Manager
CVE-2025-10490
Risk Score
Threat Entry
Updated 2025-02-11
CVE-2024-7624 - Zephyr Project Manager Plugin
The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 3.3.101. This is due to the plugin not properly checking a users capabilities before allowing them to enable access to the plugin's settings through the update_user_access() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves full access to the plugin's settings.
PLUGIN
Zephyr Project Manager
CVE-2024-7624
Risk Score
Threat Entry
Updated 2025-02-11
CVE-2024-7356 - Zephyr Project Manager Plugin
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘filename’ parameter in all versions up to, and including, 3.3.100 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Zephyr Project Manager
CVE-2024-7356
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2024-6536 - Zephyr Project Manager Plugin
The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors and admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Zephyr Project Manager
CVE-2024-6536
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-2839 - Zephyr Project Manager Plugin
The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them to perform Stored Cross-Site Scripting attacks against logged in admins.
PLUGIN
Zephyr Project Manager
CVE-2022-2839
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-2840 - Zephyr Project Manager Plugin
The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections
PLUGIN
Zephyr Project Manager
CVE-2022-2840
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2022-1822 - Zephyr Project Manager Plugin
The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘project’ parameter in versions up to, and including, 3.2.40 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Zephyr Project Manager
CVE-2022-1822
Risk Score