CVE-2024-6536medium

CVE-2024-6536: medium-severity vulnerability in Zephyr Project Manager

Zephyr Project Manager < 3.3.99 - Editor+ XSS

Published · Updated

Follow this CVE+ Monitor Zephyr Project Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.4epss 0.8%
The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors and admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
Unknown · Zephyr Project Manager
Related CVEs — Zephyr Project Manager

In the same product, most dangerous first.

CVE-2022-2840—Zephyr Project Manager < 3.2.5 - Multiple Unauthenticated SQLiEPSS 13.2%CVE-2022-2839—Zephyr Project Manager < 3.2.55 - Unauthorised AJAX Calls To Stored XSSEPSS 0.5%