The Zephyr Project Manager plugin for WordPress suffers from a stored cross‑site scripting flaw in which unsanitized input for the 'zpm_profile_picture' parameter is written to the database and later rendered without proper escaping. An attacker can embed malicious JavaScript that will execute in the browsers of users who view the affected content, allowing session hijacking, unauthorized data exfiltration, or the execution of arbitrary code and thereby compromising confidentiality, integrity, and availability of the site.

All releases of Zephyr Project Manager for WordPress up to and including version 3.3.209 contain the vulnerability. This includes the plugin packages distributed through the WordPress repository and any copies deployed on user sites, regardless of the WordPress core version, as the flaw originates in the plugin's own code.

The CVSS score of 5.4 indicates a moderate severity risk. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog. Attackers must be authenticated at least at subscription-level to inject malicious payloads, and an administrator must subsequently visit a page that triggers the mention autocomplete to execute the code. The likely attack vector is via the profile picture setting in the Zephyr account, as inferred from the stored data paths in the source references.