WordPress plugin
Zephyr Project Manager security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 22 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High4
- Medium17
- Low0
All Zephyr Project Manager vulnerabilities
Nothing in this view
No vulnerabilities match this filter. Show all.
Zephyr Project Manager: common questions
Does Zephyr Project Manager have known vulnerabilities?
Yes. VulnCrest Radar lists 22 known vulnerabilities in Zephyr Project Manager: 1 critical, 4 high, 17 medium. None are known to affect version null.
How do I check which version of Zephyr Project Manager I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Zephyr Project Manager vulnerability?
CVE-2026-120514, published Nov 6, 2026: Zephyr Project Manager <= 3.3.209 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'zpm_profile_picture' Parameter. Severity: Medium (CVSS 5.4).
Is any Zephyr Project Manager vulnerability listed in CISA KEV?
No. None of the known Zephyr Project Manager vulnerabilities is currently listed in the CISA KEV catalog.