What is CVE-2024-6536?

CVE-2024-6536 is a vulnerability in Zephyr Project Manager, classified under CWE-79 CROSS-SITE SCRIPTING (XSS). Published 2024-07-30.

Is CVE-2024-6536 known to be exploited?

5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Zephyr Project Manager

CVE-2024-6536

The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors and admins to perform Stored Cross-Site Scripting attacks even when the unf…

EPSS: 0.520 (98.0th percentile) — read the EPSS interpretation.

Affected products

Unknown Zephyr Project Manager — versions 0

Public proof-of-concept exploits

apena-ba/CVE-2024-6536
20142995/nuclei-templates
ARPSyndicate/cve-scores
fkie-cad/nvd-json-data-feeds
nomi-sec/PoC-in-GitHub

References

wpscan.com/vulnerability/ee40c1c6-4186-4b97-866c-fb0e76cedeb8/ (exploit, vdb-entry, technical-description)

Frequently asked questions

What is CVE-2024-6536?: CVE-2024-6536 is a vulnerability in Zephyr Project Manager, classified under CWE-79 CROSS-SITE SCRIPTING (XSS). Published 2024-07-30.
Is CVE-2024-6536 known to be exploited?: 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.