CVE-2026-120514 | dylanjkotze Zephyr Project Manager Plugin up to 3.3.209 on WordPress Avatar Field zpm_profile_picture cross site scripting

November 7, 2026 Yanac

A vulnerability marked as problematic has been reported in dylanjkotze Zephyr Project Manager Plugin up to 3.3.209 on WordPress. This issue affects some unknown processing of the component Avatar Field. Performing a manipulation of the argument zpm_profile_picture results in cross site scripting.

This vulnerability was named CVE-2026-120514. The attack may be initiated remotely. There is no available exploit.VulDB Recent EntriesRead More