CVE-2026-76931 is a stored cross-site scripting vulnerability in the Zephyr Project Manager plugin for WordPress. The issue arises from insufficient input sanitization and output escaping of the 'message' parameter, enabling authenticated attackers with Custom-level access or above to inject arbitrary web scripts. These scripts execute in the context of users viewing the injected pages. The vulnerability is present in all versions up to and including 3.3.205 and can only be exploited if the 'Directly link to project' plugin setting is disabled.

Successful exploitation allows an authenticated attacker with Custom-level access or higher to inject and execute arbitrary scripts in the context of other users accessing the affected pages. This can lead to information disclosure and limited integrity impact but does not affect availability. The vulnerability requires specific plugin configuration (the 'Directly link to project' setting disabled) to be exploitable.

No official patch or remediation has been confirmed at this time. Users should verify the status of the 'Directly link to project' plugin setting; enabling it may mitigate exploitation. Monitor the vendor's advisory channels for updates and apply any official fixes once available. Until then, restrict access to trusted users and consider disabling or limiting use of the affected plugin if feasible.