The Zephyr Project Manager plugin for WordPress is vulnerable to stored cross‑site scripting through the 'message' parameter. Because the plugin fails to sanitize input and escape output, an attacker who can authenticate with Custom‑level access or higher can place malicious scripts in the 'message' field, which the plugin stores and later renders unescaped in project pages. Those scripts run whenever a user views the affected project, enabling theft of session cookies, defacement, or other client‑side attacks.

This flaw is present in all releases of Zephyr Project Manager up to and including version 3.3.205. The vulnerability is only exploitable when the plugin setting 'Directly link to project' is turned off. Any WordPress installation using the affected plugin, regardless of the WordPress core version, is prone to the issue.

The CVSS score for this vulnerability is 6.4, indicating a moderate severity. EPSS data for this CVE is not available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with at least Custom‑level access and the ability to navigate to a project for which the link‑to‑project option is disabled. An attacker would first inject a crafted 'message' value via the plugin’s Ajax endpoint, which is stored in the database and later rendered when the project page is accessed by other users. Because the payload is executed in the victim’s browser, it is considered a high risk to confidentiality, integrity, and availability of user accounts.