https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T07:15:40.840625+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2022-87380 cnvd-2022-87380 2026-10-04T07:15:40.845757+00:00 cnvd-2022-87380 https://cve.radiocsirt.org/vuln/euvd-2026-12519 EUVD-2026-12519 2026-10-04T07:15:40.845819+00:00 EUVD-2026-12519 https://cve.radiocsirt.org/vuln/fkie_cve-2022-2839 fkie_cve-2022-2839 2026-10-04T07:15:40.845843+00:00

The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them to perform Stored Cross-Site Scripting attacks against logged in admins.

 https://cve.radiocsirt.org/vuln/ghsa-p2c9-6h79-p9j6 GHSA-p2c9-6h79-p9j6 2026-10-04T07:15:40.845887+00:00

The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them to perform Stored Cross-Site Scripting attacks against logged in admins.

 https://cve.radiocsirt.org/vuln/gsd-2022-2839 gsd-2022-2839 2026-10-04T07:15:40.845913+00:00 gsd-2022-2839 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-2839 UBUNTU-CVE-2022-2839 2026-10-04T07:15:40.845932+00:00

Affected: Ubuntu:16.04:LTS: wordpress, Ubuntu:16.04:LTS: zephyr, Ubuntu:18.04:LTS: wordpress, Ubuntu:18.04:LTS: zephyr, Ubuntu:20.04:LTS: wordpress, Ubuntu:20.04:LTS: zephyr, Ubuntu:22.04:LTS: wordpress, Ubuntu:22.04:LTS: zephyr, Ubuntu:24.04:LTS: wordpress, Ubuntu:24.04:LTS: zephyr and 4 more

The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them to perform Stored Cross-Site Scripting attacks against logged in admins.