https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 10 Nov 2026 04:11:48 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-120514 <p>The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;zpm_profile_picture&#39; parameter in all versions up to, and including, 3.3.209 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the subscriber&#39;s own Zephyr profile and fires in any Administrator&#39;s browser session the first time the autocomplete mention lookup renders the avatar field, requiring no additional configuration beyond the plugin&#39;s default access_roles setting. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.</p> <p>The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;zpm_profile_picture&#39; parameter in all versions up to, and including, 3.3.209 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the subscriber&#39;s own Zephyr profile and fires in any Administrator&#39;s browser session the first time the autocomplete mention lookup renders the avatar field, requiring no additional configuration beyond the plugin&#39;s default access_roles setting. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.</p> https://db.gcve.eu/vuln/fkie_cve-2026-120514 https://db.gcve.eu/vuln/ghsa-8949-rwp6-7qwg <p>The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;zpm_profile_picture&#39; parameter in all versions up to, and including, 3.3.209 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the subscriber&#39;s own Zephyr profile and fires in any Administrator&#39;s browser session the first time the autocomplete mention lookup renders the avatar field, requiring no additional configuration beyond the plugin&#39;s default access_roles setting. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.</p> <p>The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;zpm_profile_picture&#39; parameter in all versions up to, and including, 3.3.209 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the subscriber&#39;s own Zephyr profile and fires in any Administrator&#39;s browser session the first time the autocomplete mention lookup renders the avatar field, requiring no additional configuration beyond the plugin&#39;s default access_roles setting. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.</p> https://db.gcve.eu/vuln/ghsa-8949-rwp6-7qwg