Skip to content
PluginCanary

Zephyr Project Manager

by Dylan James · 1,000+ active installs · Checked 3 Nov 2026
Healthy

Healthy: released 4 days ago, tested with WordPress 7.1, no open vulnerabilities.

89/ 100Healthy
Canary Score

Based on 3 of 5 areas

Sub-scores for Zephyr Project Manager
Ownership100
Maintenance100
Security70
SupportNo data
ReputationNo data

How the score works

Active signals

Open issues right now, with links to the source.

  • InfoSEC-36 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

History: 21 past vulnerabilities, all patched. Patched issues are listed in the Security record, not here.

Quick answers

Is Zephyr Project Manager still maintained?
Yes. Last release 1 Nov 2026, 2 releases in the last 24 months. 1 Nov 2026 · wordpress.org
Who owns Zephyr Project Manager, and has it changed hands?
No change recorded. Main committer dylanjkotze since Aug 2018. 3 Nov 2026 · SVN log
Was Zephyr Project Manager removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is Zephyr Project Manager safe?
21 known vulnerabilities, all fixed (latest in 3.3.206). Not on the exploited list. 7 Sep 2026 · Wordfence Intelligence
Is the latest Zephyr Project Manager update safe to install?
No ownership change before 3.3.210. No one-star spike after it. 12 Apr 2025 · Release history

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
dylanjkotze31 Aug 2018 to 1 Nov 2026, 175 commits

1 committer recorded. No ownership changes recorded since 2018.

Maintenance

Last release
4 days ago
Releases, 24 months
2
Tested up to
7.1 current
Requires PHP
5.2.4 supported 8.2+
Releases per quarter
Releases per quarter for Zephyr Project Manager
Q1 20240
Q2 20240
Q3 20240
Q4 20240
Q1 20250
Q2 20252
Q3 20250
Q4 20250
Q1 20260
Q2 20260
Q3 20260
Q4 20260

Last release 1 Nov 2026. Tested with WordPress 7.1 (current).

Support

Resolved, last 2 months
0%
Threads, last 2 months
1

Trend appears after 8 weekly snapshots.

Security record

6 vulnerabilities in 24 months (21 on record), all patched (latest fixed in 3.3.206).

Show 21 patched vulnerabilities
DateIssueCVSSAffectedFixed inDays to patch
7 Sep 2026Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter6.4<= 3.3.2053.3.206n/a
16 Dec 2025Authenticated (Custom+) Arbitrary File Read And Server-Side Request Forgery4.9<= 3.3.2033.3.204n/a
25 Sep 2025Authenticated (Admin+) Stored Cross-Site Scripting4.4<= 3.3.2023.3.203n/a
26 Aug 2025Missing Authorization4.3<= 3.3.2013.3.202n/a
16 Apr 2025Missing Authorization4.3<= 3.3.2003.3.201Before disclosure
10 Apr 2025Reflected Cross-Site Scripting6.1<= 3.3.1013.3.102n/a
20 Aug 2024Reflected Cross-Site Scripting5.5<= 3.3.1023.3.103n/a
20 Aug 2024Missing Authorization to Authenticated (Subscriber+) Status Updates4.3<= 3.3.1023.3.103n/a
16 Aug 2024Authenticated (Subscriber+) Insecure Direct Object Reference4.3<= 3.3.1003.3.101n/a
14 Aug 2024Authenticated (Subscriber+) Limited Privilege Escalation8.1<= 3.3.1013.3.102n/a
2 Aug 2024Authenticated (Subscriber+) Stored Cross-Site Scripting via filename Parameter6.4<= 3.3.1003.3.101n/a
12 Jul 2024Unauthenticated Information Exposure5.3<= 3.3.993.3.100n/a
9 Jul 2024Authenticated (Editor+) Stored Cross-Site Scripting4.4<= 3.3.973.3.99n/a
4 Jul 2024Authenticated (Subscriber+) Privilege Escalation via User Meta Update8.8<= 3.3.973.3.99n/a
13 Jun 2023Cross-Site Request Forgery4.3<= 3.3.933.3.94n/a
27 Apr 2023Open Redirect5.4<= 3.3.93.3.10n/a
8 Sep 2022Missing Authorization to Cross-Site Scripting7.2< 3.2.553.2.55n/a
29 Aug 2022Unauthenticated SQL Injection9.8<= 3.2.4, 3.2.41, 3.2.423.2.5n/a
29 Aug 2022Missing Authorization to Cross-Site Scripting7.2<= 3.2.4, 3.2.41, 3.2.423.2.5n/a
29 Aug 2022Reflected Cross-Site Scripting6.1< 3.2.53.2.5n/a
23 May 2022Reflected Cross-Site Scripting6.1<= 3.2.4, 3.2.403.2.5n/a

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Reputation

Last 90 days: no reviews. Lifetime: 4.8.

Last 90 days vs lifetime average rating for Zephyr Project Manager
Last 90 daysNo reviews
Lifetime4.8
Rating distribution
5 star89
4 star1
3 star4
2 star2
1 star2

Momentum

Active installs
1,000+
Downloads, last full week
918
Weekly downloads, last 26 complete weeks
Weekly downloads for Zephyr Project Manager
4 May 202650
11 May 2026126
18 May 2026140
25 May 2026148
1 Jun 2026105
8 Jun 2026130
15 Jun 202681
22 Jun 202699
29 Jun 202692
6 Jul 202699
13 Jul 202698
20 Jul 2026109
27 Jul 2026138
3 Aug 2026178
10 Aug 2026145
17 Aug 2026636
24 Aug 2026256
31 Aug 2026179
7 Sep 2026220
14 Sep 2026180
21 Sep 2026343
28 Sep 2026185
5 Oct 2026830
12 Oct 20261,351
19 Oct 2026543
26 Oct 2026918

Weekly downloads over the last 4 weeks are 221% above the 26-week average.

Facts

Version
3.3.210
Author
Dylan James
Added
31 Aug 2018
Last updated
1 Nov 2026
Active installs
1,000+
Requires WordPress
3.2
Tested up to
7.1.4
Requires PHP
5.2.4
Category
not stated
Tags
Tasks, projects, task manager, collaboration, project manager

Other plugins by this author: Zephyr Admin Theme

Questions about Zephyr Project Manager

Is Zephyr Project Manager still maintained?

Yes. Last release 1 Nov 2026, 2 releases in the last 24 months.

Who owns Zephyr Project Manager, and has it changed hands?

No change recorded. Main committer dylanjkotze since Aug 2018.

Was Zephyr Project Manager removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is Zephyr Project Manager safe?

21 known vulnerabilities, all fixed (latest in 3.3.206). Not on the exploited list.

Is the latest Zephyr Project Manager update safe to install?

No ownership change before 3.3.210. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue