The vulnerability resides in the Zephyr Project Manager for WordPress, where configuration values entered by administrators are stored without proper sanitization or escaping. An attacker who can log in with administrator or higher privileges can inject malicious JavaScript into admin settings. When any user loads a page that uses those settings, the injected code runs in the visitor’s browser. The impact is the compromise of confidentiality and integrity for users who view the affected page, but does not affect the underlying server state or database directly. The weakness is a classic stored XSS flaw (CWE‑79).

Zephyr Project Manager plugin for WordPress, versions up to and including 3.3.202. The flaw is limited to multi‑site WordPress installations where the unfiltered_html capability is disabled. All other product variants, newer plugin releases, or single‑site environments are not affected.

The CVSS score of 4.4 indicates a medium risk, and the EPSS score of less than 1% shows a very low likelihood of widespread exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Because exploitation requires authentication with administrator privileges, an attacker must first compromise a privileged account or leverage an existing one. However, once authenticated, the attacker can easily inject scripts that will run for every visitor when the page is accessed, giving an opportunity for shortcut attacks such as phishing or cookie theft. Given the low public visibility and the need for privileged access, the risk is moderate but still actionable.