CVE-2026-76931

Name of the Vulnerable Software and Affected Versions Zephyr Project Manager versions prior to 3.3.206

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Custom-level access or higher can inject arbitrary web scripts into pages via the message parameter. These scripts execute when a user accesses the affected page. This issue is only exploitable if the 'Directly link to project' plugin setting is disabled.

Recommendations Update the plugin to a version newer than 3.3.205. Enable the 'Directly link to project' setting to prevent exploitation.