Stored Cross-Site Scripting Vulnerability in Zephyr Project Manager Plugin for WordPress

CVE-2026-76931

What is CVE-2026-76931?

The Zephyr Project Manager plugin for WordPress is susceptible to stored cross-site scripting (XSS) through the 'message' parameter due to inadequate input sanitization and output escaping. This allows authenticated attackers with Custom-level access or higher to inject malicious scripts into project pages, leading to unintended script execution when users access compromised pages. This vulnerability is active only if the 'Directly link to project' feature is disabled, making it crucial for site administrators to review their plugin settings and upgrade to the latest version to prevent exploitation.

References