Zephyr Project Manager

75 Quality Score

Active Installs

14/30

With only 1,000 active installs, it has a modest reach, well below the category leaders like Desert Companion at 20,000, though it is overperforming its install base.

Update Freshness

25/25

Last updated February 2026 and tested against WordPress 6.9.4, the plugin is clearly and consistently maintained by an active developer.

User Rating

14/15

A 96 out of 100 from 98 ratings is a strong endorsement, suggesting users who try it tend to be very satisfied with the experience.

Support Health

8/15

With 0 of 1 support threads resolved, there is too little data to declare a support problem, but the lack of any resolved cases is a minor concern worth watching.

WP Compatibility

15/15

Compatible with WordPress 3.2 and PHP 5.2.4 and confirmed tested on WordPress 6.9.4, it works across an unusually wide range of environments.

Scores higher than 41% of indexed plugins

About

Zephyr Project Manager is a modern, easy to use sophisticated project manager for WordPress.

Active Installs 1k+

Rating ★★★★½ 4.8/5

Last Updated 2026-08-20 1:12pm GMT

Requires WordPress 3.2+

Tested Up To 7.1

Requires PHP 5.2.4+

Security History

21 known vulnerabilities, all patched

1 Critical 4 High 16 Medium

Most recent: September 7, 2026

View details ▸

Zephyr Project Manager <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter Medium

September 7, 2026 Patched in ["3.3.206"] CVE-2026-76931

Zephyr Project Manager <= 3.3.203 - Authenticated (Custom+) Arbitrary File Read And Server-Side Request Forgery Medium

December 16, 2025 Patched in ["3.3.204"] CVE-2025-12496

Zephyr Project Manager <= 3.3.202 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

September 25, 2025 Patched in ["3.3.203"] CVE-2025-10490

Zephyr Project Manager <= 3.3.201 - Missing Authorization Medium

August 26, 2025 Patched in ["3.3.202"] CVE-2025-54714

Zephyr Project Manager <= 3.3.200 - Missing Authorization Medium

April 16, 2025 Patched in ["3.3.201"] CVE-2025-39552

Zephyr Project Manager <= 3.3.101 - Reflected Cross-Site Scripting Medium

April 10, 2025 Patched in ["3.3.102"] CVE-2025-32526

Zephyr Project Manager <= 3.3.102 - Reflected Cross-Site Scripting Medium

August 20, 2024 Patched in ["3.3.103"] CVE-2024-43915

Zephyr Project Manager <= 3.3.102 - Missing Authorization to Authenticated (Subscriber+) Status Updates Medium

August 20, 2024 Patched in ["3.3.103"] CVE-2024-43916

Zephyr Project Manager <= 3.3.100 - Authenticated (Subscriber+) Insecure Direct Object Reference Medium

August 16, 2024 Patched in ["3.3.101"] CVE-2024-43322

Zephyr Project Manager <= 3.3.101 - Authenticated (Subscriber+) Limited Privilege Escalation High

August 14, 2024 Patched in ["3.3.102"] CVE-2024-7624

Zephyr Project Manager <= 3.3.100 - Authenticated (Subscriber+) Stored Cross-Site Scripting via filename Parameter Medium

August 2, 2024 Patched in ["3.3.101"] CVE-2024-7356

Zephyr Project Manager <= 3.3.99 - Unauthenticated Information Exposure Medium

July 12, 2024 Patched in ["3.3.100"] CVE-2024-38761

Zephyr Project Manager <= 3.3.97 - Authenticated (Editor+) Stored Cross-Site Scripting Medium

July 9, 2024 Patched in ["3.3.99"] CVE-2024-6536

Zephyr Project Manager <= 3.3.97 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update High

July 4, 2024 Patched in ["3.3.99"] CVE-2024-37484

Zephyr Project Manager <= 3.3.93 - Cross-Site Request Forgery Medium

June 13, 2023 Patched in ["3.3.94"] CVE-2023-34373

Zephyr Project Manager <= 3.3.9 - Open Redirect Medium

April 27, 2023 Patched in ["3.3.10"] CVE-2023-31237

Zephyr Project Manager < 3.2.55 - Missing Authorization to Cross-Site Scripting High

September 8, 2022 Patched in ["3.2.55"] CVE-2022-2839

Zephyr Project Manager <= 3.2.42 - Reflected Cross-Site Scripting Medium

August 29, 2022 Patched in ["3.2.5"]

Zephyr Project Manager <= 3.2.42 - Missing Authorization to Cross-Site Scripting High

August 29, 2022 Patched in ["3.2.5"]

Zephyr Project Manager <= 3.2.42 - Unauthenticated SQL Injection Critical

August 29, 2022 Patched in ["3.2.5"] CVE-2022-2840

Zephyr Project Manager <= 3.2.40 - Reflected Cross-Site Scripting Medium

May 23, 2022 Patched in ["3.2.41","3.2.5"] CVE-2022-1822

What It Does

Zephyr Project Manager turns a WordPress site into a lightweight project and task management hub, letting teams create projects, assign tasks, and track progress from the wp-admin dashboard. It centralizes collaboration features like task assignment and status tracking without requiring a third-party SaaS subscription.

Who It's For

It is a good fit for small agencies, freelance teams, and small businesses that already rely on WordPress and want basic project tracking without adopting a dedicated platform like Asana or ClickUp. Solo operators juggling client work and small remote teams with simple workflows will get the most value from its lightweight footprint.

Who Should Skip It

If you run a larger organization with complex dependencies, advanced reporting, or integrations with tools like Jira or Slack, you will outgrow Zephyr quickly and should consider a more feature-rich alternative.

The Bottom Line

Zephyr Project Manager is a polished, well-maintained niche tool that punches above its weight, scoring 75.33 out of 100 with near-perfect ratings despite a small install base. Its tiny footprint and broad compatibility make it appealing for small WordPress-based teams, but the low install count and minimal support track record mean larger operations should test it carefully before committing.

Pick FluentBoards instead if you want Kanban views and goal tracking and need a more widely adopted solution with 6,000 installs.

BuddyPress Docs 78/100

Choose BuddyPress Docs when your priority is collaborative documentation within a BuddyPress community rather than task and project tracking.

Dashboard To-Do List 76/100

Pick Dashboard To-Do List if you only need a personal admin task list and do not require multi-user project coordination.

Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker 76/100

Choose this WeDevs alternative when AI features, Kanban boards, and time tracking are higher priorities than Zephyr's simpler interface.

Desert Companion 73/100

Pick Desert Companion if you want a broadly installed companion plugin for starter sites rather than a dedicated project management tool.