Skip to content
Sign in
Not rated

CVE-2022-2839 The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its…

Description

The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them to perform Stored Cross-Site Scripting attacks against logged in admins.

Affected products and versions

Product Affected versions Fixed in
Zephyr Project Manager 3.2 earliest → < 3.2.55 3.2.55

Other CVEs of Zephyr Project Manager

The 3 CVEs of Zephyr Project Manager →
CVE-2024-6536 The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could… 5.4 Medium CVE-2022-2840 The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using… Not rated
Track this CVE