Stored Cross-Site Scripting Vulnerability in Zephyr Project Manager for WordPress

CVE-2026-120514

What is CVE-2026-120514?

The Zephyr Project Manager plugin for WordPress is prone to a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping of the 'zpm_profile_picture' parameter. This issue is present in all versions up to 3.3.209, enabling authenticated users with subscriber-level access or higher to inject malicious web scripts. These scripts can execute when an affected user accesses a profile, with the payload stored in the user's profile and activated during a lookup in any Administrator's session. Successful exploitation requires an admin's interaction, allowing the attacker to indirectly trigger the vulnerabilities without additional configuration.

References