WordPress plugin
Zephyr Project Manager security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 22 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High4
- Medium17
- Low0
All Zephyr Project Manager vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium5.4 | Authenticated (Subscriber+) Stored Cross-Site Scripting via 'zpm_profile_picture' Parameter ≤3.3.209Update to 3.3.210 | CVE-2026-120514 | |
| Medium6.4 | Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter ≤3.3.205Update to 3.3.206 | CVE-2026-76931 | |
| Medium4.9 | Authenticated (Custom+) Arbitrary File Read And Server-Side Request Forgery ≤3.3.203Update to 3.3.204 | CVE-2025-12496 | |
| Medium4.4 | Authenticated (Admin+) Stored Cross-Site Scripting ≤3.3.202Update to 3.3.203 | CVE-2025-10490 | |
| Medium4.3 | Missing Authorization ≤3.3.201Update to 3.3.202 | CVE-2025-54714 | |
| Medium4.3 | Missing Authorization ≤3.3.200Update to 3.3.201 | CVE-2025-39552 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤3.3.101Update to 3.3.102 | CVE-2025-32526 | |
| Medium5.5 | Reflected Cross-Site Scripting ≤3.3.102Update to 3.3.103 | CVE-2024-43915 | |
| Medium4.3 | Missing Authorization to Authenticated (Subscriber+) Status Updates ≤3.3.102Update to 3.3.103 | CVE-2024-43916 | |
| Medium4.3 | Authenticated (Subscriber+) Insecure Direct Object Reference ≤3.3.100Update to 3.3.101 | CVE-2024-43322 | |
| High8.1 | Authenticated (Subscriber+) Limited Privilege Escalation ≤3.3.101Update to 3.3.102 | CVE-2024-7624 | |
| Medium6.4 | Authenticated (Subscriber+) Stored Cross-Site Scripting via filename Parameter ≤3.3.100Update to 3.3.101 | CVE-2024-7356 | |
| Medium5.3 | Unauthenticated Information Exposure ≤3.3.99Update to 3.3.100 | CVE-2024-38761 | |
| Medium4.4 | Authenticated (Editor+) Stored Cross-Site Scripting ≤3.3.97Update to 3.3.99 | CVE-2024-6536 | |
| High8.8 | Authenticated (Subscriber+) Privilege Escalation via User Meta Update ≤3.3.97Update to 3.3.99 | CVE-2024-37484 | |
| Medium4.3 | Cross-Site Request Forgery ≤3.3.93Update to 3.3.94 | CVE-2023-34373 | |
| Medium5.4 | Open Redirect ≤3.3.9Update to 3.3.10 | CVE-2023-31237 | |
| High7.2 | Missing Authorization to Cross-Site Scripting <3.2.55Update to 3.2.55 | CVE-2022-2839 | |
| Critical9.8 | Unauthenticated SQL Injection ≤3.2.42Update to 3.2.5 | CVE-2022-2840 | |
| High7.2 | Missing Authorization to Cross-Site Scripting ≤3.2.42Update to 3.2.5 | — | |
| Medium6.1 | Reflected Cross-Site Scripting <3.2.5Update to 3.2.5 | — | |
| Medium6.1 | Reflected Cross-Site Scripting ≤3.2.40Update to 3.2.41 or 3.2.5 | CVE-2022-1822 |
- Medium5.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'zpm_profile_picture' Parameter
≤3.3.209Update to 3.3.210
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter
≤3.3.205Update to 3.3.206
- Medium4.9Authenticated (Custom+) Arbitrary File Read And Server-Side Request Forgery
≤3.3.203Update to 3.3.204
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤3.3.202Update to 3.3.203
- Medium4.3Missing Authorization
≤3.3.201Update to 3.3.202
- Medium4.3Missing Authorization
≤3.3.200Update to 3.3.201
- Medium6.1Reflected Cross-Site Scripting
≤3.3.101Update to 3.3.102
- Medium5.5Reflected Cross-Site Scripting
≤3.3.102Update to 3.3.103
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Status Updates
≤3.3.102Update to 3.3.103
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
≤3.3.100Update to 3.3.101
- High8.1Authenticated (Subscriber+) Limited Privilege Escalation
≤3.3.101Update to 3.3.102
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via filename Parameter
≤3.3.100Update to 3.3.101
- Medium5.3Unauthenticated Information Exposure
≤3.3.99Update to 3.3.100
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
≤3.3.97Update to 3.3.99
- High8.8Authenticated (Subscriber+) Privilege Escalation via User Meta Update
≤3.3.97Update to 3.3.99
- Medium4.3Cross-Site Request Forgery
≤3.3.93Update to 3.3.94
- Medium5.4Open Redirect
≤3.3.9Update to 3.3.10
- High7.2Missing Authorization to Cross-Site Scripting
<3.2.55Update to 3.2.55
- Critical9.8Unauthenticated SQL Injection
≤3.2.42Update to 3.2.5
- High7.2Missing Authorization to Cross-Site Scripting
≤3.2.42Update to 3.2.5
- Medium6.1Reflected Cross-Site Scripting
<3.2.5Update to 3.2.5
- Medium6.1Reflected Cross-Site Scripting
≤3.2.40Update to 3.2.41 or 3.2.5
Zephyr Project Manager: common questions
Does Zephyr Project Manager have known vulnerabilities?
Yes. VulnCrest Radar lists 22 known vulnerabilities in Zephyr Project Manager: 1 critical, 4 high, 17 medium. None are known to affect version null.
How do I check which version of Zephyr Project Manager I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Zephyr Project Manager vulnerability?
CVE-2026-120514, published Nov 6, 2026: Zephyr Project Manager <= 3.3.209 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'zpm_profile_picture' Parameter. Severity: Medium (CVSS 5.4).
Is any Zephyr Project Manager vulnerability listed in CISA KEV?
No. None of the known Zephyr Project Manager vulnerabilities is currently listed in the CISA KEV catalog.