CVE-2025-32526 WordPress Zephyr Project Manager plugin <= 3.3.101 - Cross Site Scripting (XSS) vulnerability

What is CVE-2025-32526?

CVE-2025-32526 is a high-severity cross-site scripting vulnerability in Dylan James Zephyr Project Manager, published on 17 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Reflected XSS.This issue affects Zephyr Project Manager: from n/a through <= 3.3.101.

Weakness: CWE-79

Which versions are affected by CVE-2025-32526?

It affects 1 product.

Products include Zephyr-One Zephyr Project Manager.

How do I fix CVE-2025-32526?

No fix has been published for CVE-2025-32526 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-32526 being exploited?

There is no known exploitation of CVE-2025-32526 in the wild and no public exploit code.

Other vulnerabilities in Dylan James Zephyr Project Manager

• CVE-2022-2840 Zephyr Project Manager < 3.2.5 - Multiple Unauthenticated SQLi Critical 9.8
• CVE-2024-37484 WordPress Zephyr Project Manager plugin <= 3.3.97 - Privilege Escalation vulnerability High 8.8
• CVE-2024-7624 Zephyr Project Manager <= 3.3.101 - Authenticated (Subscriber+) Limited Privilege Escalation High 8.1
• CVE-2024-38761 WordPress Zephyr Project Manager plugin <= 3.3.99 - Sensitive Data Exposure via Export File vulnerability High 7.5
• CVE-2024-7356 Zephyr Project Manager <= 3.3.100 - Authenticated (Subscriber+) Stored Cross-Site Scripting via filename Parameter Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qg7m-x7h8-fwj3.