PatchTheCVE: zephyr-onehttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2025-32526: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Jahttps://patchthecve.com/cve/CVE-2025-32526.htmlhttps://patchthecve.com/cve/CVE-2025-32526.htmlWed, 17 Jun 2026 09:12:09 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Reflected XSS.This issue affects Zephyr Project Manager: from n/a through <= 3.3.101.CVE-2024-43915: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dhttps://patchthecve.com/cve/CVE-2024-43915.htmlhttps://patchthecve.com/cve/CVE-2024-43915.htmlWed, 17 Jun 2026 07:51:59 +0000MEDIUM 5.5: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dylan James Zephyr Project Manager allows Reflected XSS.This issue affects Zephyr Project Manager: from n/a through .3.102.CVE-2024-43322: Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issuhttps://patchthecve.com/cve/CVE-2024-43322.htmlhttps://patchthecve.com/cve/CVE-2024-43322.htmlWed, 17 Jun 2026 07:50:48 +0000MEDIUM 5.4: Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.100.CVE-2024-7624: The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions https://patchthecve.com/cve/CVE-2024-7624.htmlhttps://patchthecve.com/cve/CVE-2024-7624.htmlWed, 17 Jun 2026 08:20:34 +0000HIGH 8.1: The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 3.3.101. This is due to the plugin not properly checking a users capabilities before allowing them to enable access to the plugin's settings through the update_user_accCVE-2024-38761: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Dylan James Zephyr Project Managerhttps://patchthecve.com/cve/CVE-2024-38761.htmlhttps://patchthecve.com/cve/CVE-2024-38761.htmlWed, 17 Jun 2026 07:41:00 +0000HIGH 7.5: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.99.CVE-2024-37484: Improper Privilege Management vulnerability in Dylan James Zephyr Project Manager allows Privilege Escalation.https://patchthecve.com/cve/CVE-2024-37484.htmlhttps://patchthecve.com/cve/CVE-2024-37484.htmlWed, 17 Jun 2026 07:38:27 +0000HIGH 8.8: Improper Privilege Management vulnerability in Dylan James Zephyr Project Manager allows Privilege Escalation.This issue affects Zephyr Project Manager: from n/a through 3.3.97.