CVE-2026-120514 Details

A stored cross-site scripting vulnerability has been identified in the Zephyr Project Manager plugin for WordPress, affecting all versions through 3.3.209. The issue arises from inadequate input sanitization and output escaping, allowing authenticated attackers with subscriber-level access or higher to inject arbitrary scripts. These scripts are executed when a user accesses the affected page, with the payload being stored in the subscriber's Zephyr profile. The vulnerability activates in an Administrator's browser session the first time the avatar field is rendered, requiring no additional configuration beyond the default access_roles setting. Exploitation also necessitates an action from an administrator, as the attacker cannot trigger the vulnerability independently.

Users are advised to update the Zephyr Project Manager plugin to version 3.3.210 or a newer patched version.