Skip to content
Sign in
6.4 Medium

CVE-2026-102402 The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…

Description

The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttp_filter_taxonomy (meta of the attacker-chosen post)' parameter in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected products and versions

Product Affected versions Fixed in
Team – Team Members Showcase Plugin 6.0 earliest → 6.0.2 No fix stated

Other CVEs of Team – Team Members Showcase Plugin

The 2 CVEs of Team – Team Members Showcase Plugin →
CVE-2024-13439 The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing… 4.3 Medium
Track this CVE