CVE-2025-10490 Overview
CVE-2025-10490 is a Stored Cross-Site Scripting (XSS) vulnerability in the Zephyr Project Manager plugin for WordPress. The flaw affects all versions up to and including 3.3.202. It stems from insufficient input sanitization and output escaping in the plugin's admin settings. Authenticated attackers with administrator-level permissions can inject arbitrary JavaScript that executes when other users access affected pages. The issue is scoped to multi-site installations and installations where unfiltered_html has been disabled. It is classified under CWE-79.
Critical Impact
Injected scripts execute in the browser context of any user viewing affected admin pages, enabling session hijacking, privilege abuse, and network-scope compromise across multi-site WordPress deployments.
Affected Products
- Zephyr Project Manager plugin for WordPress, versions up to and including 3.3.202
- WordPress multi-site installations running the affected plugin
- WordPress installations where the unfiltered_html capability is disabled
Discovery Timeline
- 2025-09-26 - CVE-2025-10490 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10490
Vulnerability Analysis
The Zephyr Project Manager plugin fails to sanitize input and escape output within its admin settings interface. Values submitted through those settings are stored in the WordPress database and later rendered in administrative pages without proper encoding. This allows an authenticated administrator to persist arbitrary HTML and JavaScript payloads.
Because the payload is stored, execution occurs whenever any user loads the affected page. In multi-site environments, administrators of individual sites operate under lower trust than super-administrators. The vulnerability lets a site administrator escalate influence by injecting scripts that run in the browsers of network super-administrators.
When unfiltered_html is disabled, WordPress normally strips risky markup from privileged input. The plugin bypasses this control path by handling its own settings persistence without equivalent filtering. See the Wordfence Vulnerability Report for the vendor-neutral advisory.
Root Cause
The root cause is missing sanitization on write and missing escaping on read. Plugin code accepts administrator-supplied settings values and stores them verbatim. During rendering, the values are emitted into HTML contexts without functions such as esc_html(), esc_attr(), or wp_kses().
Attack Vector
An attacker must first hold administrator credentials on an affected site. On a multi-site network, this includes single-site administrators who are not network super-admins. The attacker submits a crafted payload through the plugin's admin settings form. The payload is stored and later executed against any user who visits the injected page. Exploitation requires no user interaction beyond normal page navigation.
The vulnerability mechanism is documented in the fix committed to the plugin repository. See the WordPress Plugin Changeset for the code-level remediation.
Detection Methods for CVE-2025-10490
Indicators of Compromise
- Unexpected <script> tags, event handlers, or javascript: URIs stored in Zephyr Project Manager settings rows within the WordPress options or plugin-specific tables
- Administrator sessions issuing outbound requests to unfamiliar domains shortly after loading plugin admin pages
- New administrator accounts, altered user roles, or modified plugin options following visits to the plugin's settings pages
Detection Strategies
- Review plugin settings values in the database for HTML control characters such as <, >, and on*= attribute patterns
- Inspect WordPress audit logs for update_option calls originating from the Zephyr Project Manager settings screens
- Correlate administrator authentication events with subsequent script-triggered network activity in browser telemetry
Monitoring Recommendations
- Enable a WordPress activity log plugin to record option changes and administrator actions with user attribution
- Deploy a Web Application Firewall (WAF) capable of inspecting POST bodies to /wp-admin/ endpoints for XSS payload signatures
- Alert on modifications to plugin options that introduce HTML or JavaScript into fields expected to contain plain text
How to Mitigate CVE-2025-10490
Immediate Actions Required
- Update the Zephyr Project Manager plugin to a version later than 3.3.202 on all sites within the network
- Audit administrator accounts on multi-site installations and remove unused or over-privileged roles
- Review current plugin settings for previously injected payloads and remove any unexpected markup
Patch Information
The vendor addressed the flaw in a release following version 3.3.202. The corresponding code change is available in the WordPress Plugin Changeset. Administrators should apply the update through the WordPress plugin management interface and confirm the installed version reflects the fixed release.
Workarounds
- Deactivate the Zephyr Project Manager plugin on multi-site installations until the patched version is applied
- Restrict administrator role assignments on multi-site networks to trusted users only
- Restore the unfiltered_html capability for super-administrators via a network-level configuration where operationally acceptable, understanding this does not remediate the underlying flaw
# Verify installed plugin version across a multi-site network
wp plugin list --name=zephyr-project-manager --field=version --network
# Update the plugin to the latest available release
wp plugin update zephyr-project-manager --network
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
