CVE-2022-2839 | BDVDB-2026-185757 Detail

Zephyr Project Manager

Description#

The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them to perform Stored Cross-Site Scripting attacks against logged in admins.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-352 Cross-Site Request Forgery (CSRF)

References#

https://wpscan.com/vulnerability/82e01f95-81c2-46d8-898e-07b3b8a3f8c9

Exploit#

No public exploit known

History#

Version 12022-10-03Record published in the CVE List.
Version 22024-08-03Most recent update recorded in the CVE List.