Dylan James vulnerabilities

Products

• Zephyr Project Manager 10
• Zephyr Admin Theme 1

Latest Dylan James CVEs

Newest publication first

1. CVE-2025-54714 WordPress Zephyr Project Manager Plugin <= 3.3.201 - Broken Access Control Vulnerability

   Published 2025-08-28

   High·CVSS 7.1 EPSS 0.22%

   Missing Authorization vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zephyr Project Manager: from n/a through <= 3.3.201.

2. CVE-2025-32526 WordPress Zephyr Project Manager plugin <= 3.3.101 - Cross Site Scripting (XSS) vulnerability

   Published 2025-04-17

   Medium·CVSS 6.1 EPSS 0.32%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Reflected XSS.This issue affects Zephyr Project Manager: from n/a through <= 3.3.101.

3. CVE-2025-39552 WordPress Zephyr Project Manager plugin <= 3.3.200 - Broken Access Control Vulnerability

   Published 2025-04-16

   Medium·CVSS 5.4 EPSS 0.37%

   Missing Authorization vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zephyr Project Manager: from n/a through <= 3.3.200.

4. CVE-2025-22814 WordPress Zephyr Admin Theme Plugin <= 1.4.1 - CSRF to Stored XSS vulnerability

   Published 2025-01-09

   High·CVSS 7.1 EPSS 0.16%

   Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Admin Theme zephyr-modern-admin-theme allows Cross Site Request Forgery.This issue affects Zephyr Admin Theme: from n/a through <= 1.4.1.

5. CVE-2024-43915 WordPress Zephyr Project Manager plugin <=3.3.102 - Cross Site Scripting (XSS) vulnerability

   Published 2024-08-26

   Medium·CVSS 5.4 EPSS 0.26%

   Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dylan James Zephyr Project Manager allows Reflected XSS.This issue affects Zephyr Project Manager: from n/a through .3.102.

6. CVE-2024-43916 WordPress Zephyr Project Manager plugin <= 3.3.102 - Insecure Direct Object References (IDOR) vulnerability

   Published 2024-08-26

   High·CVSS 7.1 EPSS 0.32%

   Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.102.

7. CVE-2024-43322 WordPress Zephyr Project Manager plugin <= 3.3.100 - Insecure Direct Object References (IDOR) vulnerability

   Published 2024-08-18

   Critical·CVSS 9.8 EPSS 0.37%

   Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.100.

8. CVE-2024-38761 WordPress Zephyr Project Manager plugin <= 3.3.99 - Sensitive Data Exposure via Export File vulnerability

   Published 2024-08-01

   High·CVSS 7.5 EPSS 0.45%

   Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.99.

9. CVE-2024-37484 WordPress Zephyr Project Manager plugin <= 3.3.97 - Privilege Escalation vulnerability

   Published 2024-07-09

   High·CVSS 8.8 EPSS 0.44%

   Improper Privilege Management vulnerability in Dylan James Zephyr Project Manager allows Privilege Escalation.This issue affects Zephyr Project Manager: from n/a through 3.3.97.

10. CVE-2023-31237 WordPress Zephyr Project Manager Plugin <= 3.3.9 is vulnerable to Open Redirection

    Published 2023-12-29

    Medium·CVSS 6.1 EPSS 0.36%

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.9.

11. CVE-2023-34373 WordPress Zephyr Project Manager Plugin <= 3.3.93 is vulnerable to Cross Site Request Forgery (CSRF)

    Published 2023-06-19

    High·CVSS 8.8 EPSS 0.25%

    Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Project Manager plugin <= 3.3.93 versions.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.