What’s Vulnerable › Products
Dylan James Zephyr Project Manager vulnerabilities
15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.
Check whether your Dylan James Zephyr Project Manager version is affected
Latest Dylan James Zephyr Project Manager vulnerabilities
- CVE-2026-76931 — Zephyr Project Manager <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter (CVSS 6.4)
- CVE-2025-12496 — Zephyr Project Manager <= 3.3.203 - Authenticated (Custom+) Arbitrary File Read And Server-Side Request Forgery (CVSS 4.9)
- CVE-2025-10490 — Zephyr Project Manager <= 3.3.202 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4)
- CVE-2025-54714 — WordPress Zephyr Project Manager Plugin <= 3.3.201 - Broken Access Control Vulnerability (CVSS 7.1)
- CVE-2025-32526 — WordPress Zephyr Project Manager plugin <= 3.3.101 - Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
- CVE-2025-39552 — WordPress Zephyr Project Manager plugin <= 3.3.200 - Broken Access Control Vulnerability (CVSS 5.4)
- CVE-2024-43915 — WordPress Zephyr Project Manager plugin <=3.3.102 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
- CVE-2024-43322 — WordPress Zephyr Project Manager plugin <= 3.3.100 - Insecure Direct Object References (IDOR) vulnerability (CVSS 9.8)
- CVE-2024-7624 — Zephyr Project Manager <= 3.3.101 - Authenticated (Subscriber+) Limited Privilege Escalation (CVSS 8.1)
- CVE-2024-7356 — Zephyr Project Manager <= 3.3.100 - Authenticated (Subscriber+) Stored Cross-Site Scripting via filename Parameter (CVSS 5.4)
- CVE-2024-38761 — WordPress Zephyr Project Manager plugin <= 3.3.99 - Sensitive Data Exposure via Export File vulnerability (CVSS 7.5)
- CVE-2024-37484 — WordPress Zephyr Project Manager plugin <= 3.3.97 - Privilege Escalation vulnerability (CVSS 8.8)
- CVE-2022-2839 — Zephyr Project Manager < 3.2.55 - Unauthorised AJAX Calls To Stored XSS (CVSS 5.4)
- CVE-2022-3333 — Zephyr Project Manager REST Call cross site scripting (CVSS 5.4)
- CVE-2022-2840 — Zephyr Project Manager < 3.2.5 - Multiple Unauthenticated SQLi (CVSS 9.8)