CVE-2025-10490 is a stored cross-site scripting vulnerability in the Zephyr Project Manager plugin for WordPress, affecting all versions up to 3.3.202. The vulnerability results from improper neutralization of input during web page generation (CWE-79), specifically in admin settings. Authenticated users with administrator-level permissions can inject arbitrary scripts that execute in the context of other users viewing the affected pages. This vulnerability is limited to multi-site WordPress installations or those where the unfiltered_html capability is disabled, increasing the attack surface in such configurations. The CVSS 3.1 base score is 4.4, indicating medium severity, with network attack vector, high attack complexity, and requiring high privileges but no user interaction.

Successful exploitation allows an authenticated administrator to inject and execute arbitrary JavaScript in the context of users accessing the injected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or modification of displayed content. The vulnerability does not affect availability and requires high privileges, limiting the scope to trusted users with admin rights. There are no known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Administrators should exercise caution with multi-site installations and configurations where unfiltered_html is disabled. Restrict administrator access to trusted personnel only. Monitor vendor advisories for updates or patches addressing this issue. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.