Skip to content
OpenAdvisories

Vendor

dylanjkotze

7 known vulnerabilities.

Products

Zephyr Project Manager 7
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-120514

    Zephyr Project Manager <= 3.3.209 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'zpm_profile_picture' Parameter

    The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'zpm_profile_picture' parameter in all versions up to, and including, 3.3.209 due to insufficient input sanitization and output escaping. This makes it possib…

    dylanjkotze Zephyr Project Manager Web / CMS
  • Medium 6.4
    CVE-2026-76931

    Zephyr Project Manager <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter

    The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authe…

    dylanjkotze Zephyr Project Manager Web / CMS
  • Medium 4.9
    CVE-2025-12496

    Zephyr Project Manager <= 3.3.203 - Authenticated (Custom+) Arbitrary File Read And Server-Side Request Forgery

    The Zephyr Project Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.203 via the `file` parameter. This makes it possible for authenticated attackers, with Custom-level access and above, to read the co…

    dylanjkotze Zephyr Project Manager Web / CMS
  • Medium 4.4
    CVE-2025-10490

    Zephyr Project Manager <= 3.3.202 - Authenticated (Admin+) Stored Cross-Site Scripting

    The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.3.202 due to insufficient input sanitization and output escaping. This makes it possible for authenticated …

    dylanjkotze Zephyr Project Manager Web / CMS
  • Medium 6.4
    CVE-2024-7356

    Zephyr Project Manager <= 3.3.100 - Authenticated (Subscriber+) Stored Cross-Site Scripting via filename Parameter

    The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘filename’ parameter in all versions up to, and including, 3.3.100 due to insufficient input sanitization and output escaping. This makes it possible for auth…

    dylanjkotze Zephyr Project Manager Web / CMS
  • Medium 6.1
    CVE-2022-1822

    Zephyr Project Manager <= 3.2.40 - Reflected Cross-Site Scripting

    The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘project’ parameter in versions up to, and including, 3.2.40 due to insufficient input sanitization and output escaping. This makes it possible for unauthe…

    dylanjkotze Zephyr Project Manager Web / CMS