WordPress plugin
Zephyr Project Manager security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 22 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High4
- Medium17
- Low0
All Zephyr Project Manager vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.1 | Authenticated (Subscriber+) Limited Privilege Escalation ≤3.3.101Update to 3.3.102 | CVE-2024-7624 | |
| High8.8 | Authenticated (Subscriber+) Privilege Escalation via User Meta Update ≤3.3.97Update to 3.3.99 | CVE-2024-37484 | |
| High7.2 | Missing Authorization to Cross-Site Scripting <3.2.55Update to 3.2.55 | CVE-2022-2839 | |
| Critical9.8 | Unauthenticated SQL Injection ≤3.2.42Update to 3.2.5 | CVE-2022-2840 | |
| High7.2 | Missing Authorization to Cross-Site Scripting ≤3.2.42Update to 3.2.5 | — |
- High8.1Authenticated (Subscriber+) Limited Privilege Escalation
≤3.3.101Update to 3.3.102
- High8.8Authenticated (Subscriber+) Privilege Escalation via User Meta Update
≤3.3.97Update to 3.3.99
- High7.2Missing Authorization to Cross-Site Scripting
<3.2.55Update to 3.2.55
- Critical9.8Unauthenticated SQL Injection
≤3.2.42Update to 3.2.5
- High7.2Missing Authorization to Cross-Site Scripting
≤3.2.42Update to 3.2.5
Zephyr Project Manager: common questions
Does Zephyr Project Manager have known vulnerabilities?
Yes. VulnCrest Radar lists 22 known vulnerabilities in Zephyr Project Manager: 1 critical, 4 high, 17 medium. None are known to affect version null.
How do I check which version of Zephyr Project Manager I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Zephyr Project Manager vulnerability?
CVE-2026-120514, published Nov 6, 2026: Zephyr Project Manager <= 3.3.209 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'zpm_profile_picture' Parameter. Severity: Medium (CVSS 5.4).
Is any Zephyr Project Manager vulnerability listed in CISA KEV?
No. None of the known Zephyr Project Manager vulnerabilities is currently listed in the CISA KEV catalog.