Adrian Peña Barragan

**Name of the Vulnerable Software and Affected Versions** Zephyr Project Manager WordPress plugin versions prior to 3.3.99 **Description** The issue allows high privilege users, such as editors and admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised and escaped, and the attack can occur even when the unfiltered html capability is disallowed, for example in a multisite setup. **Recommendations** For versions prior to 3.3.99, update to version 3.3.99 or later to resolve the issue.