CVE-2026-12114: Stored XSS in Team Members WordPress Plugin – CVSS 4.4

Technical summary

The Team Members plugin (all versions through 8.7) fails to properly sanitize user input in its admin settings panel and does not adequately escape output when rendering those settings. This creates a Stored XSS vulnerability (CWE-79) reachable through the WordPress admin interface. The attack surface is limited by two conditions: the WordPress installation must be either a multisite deployment or have unfiltered_html disabled (a configuration that removes the ability for administrators to post raw HTML). An authenticated attacker with administrator role can craft malicious JavaScript payloads in plugin settings that execute with the privileges of any user who accesses a page containing the injected content. The CVSS 3.1 score of 4.4 (MEDIUM) reflects the requirement for high-privilege authentication and limited scope of affected configurations.

Business impact

If your WordPress deployment uses this plugin on a multisite network or disables unfiltered_html, a compromised or malicious administrator account could inject scripts that capture user data, modify page content, or perform actions on behalf of other logged-in users. Unlike reflected XSS, this attack persists, affecting all visitors to the compromised page repeatedly. However, the requirement for administrator-level access significantly reduces the immediate threat surface for most organizations—this is primarily a risk of insider abuse or compromise of a high-privilege account.

Affected systems

The Team Members – Multi Language Supported Team Plugin for WordPress versions 8.7 and earlier. The vulnerability only affects: (1) WordPress multisite installations, or (2) WordPress single-site installations where the unfiltered_html user capability has been disabled. Standard WordPress single-site installations with default settings are not affected because unfiltered_html is enabled by default for administrators.

Exploitability

Exploitation requires valid WordPress administrator credentials or access to an administrator account. The CVSS access complexity is High (AC:H), reflecting the authentication barrier. An attacker cannot trigger this vulnerability remotely without credentials. Once authenticated, injecting the payload requires only basic familiarity with WordPress admin interfaces. However, the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting no evidence of active exploitation in the wild as of the current date.

Remediation

Update the Team Members plugin to a version after 8.7 that includes input sanitization and output escaping fixes. Verify the fix version against the official WordPress plugin repository or vendor advisory. As an interim control, restrict administrator role assignment to only trusted staff members, audit existing administrators, and monitor plugin settings changes through WordPress audit logging or security plugins.

Patch guidance

Check the plugin's update status in the WordPress admin dashboard (Plugins > Installed Plugins). Upgrade to the latest available version, which should be later than 8.7. Before upgrading in production, test the update in a staging environment to ensure compatibility with your theme and other plugins. Review the vendor's changelog or advisory to confirm the security fixes are included in the target version.

Detection guidance

Monitor WordPress admin audit logs for changes to the Team Members plugin settings, especially by users with administrator role. Web Application Firewalls (WAF) can detect stored XSS patterns in plugin configuration POST requests using signatures for common script injection payloads. Additionally, scan your multisite installation's database for suspicious JavaScript patterns in plugin option records using MySQL queries that search for common XSS indicators (e.g., '<script', 'onerror=', 'onload='). WordPress security plugins (e.g., Wordfence, Sucuri) may also flag suspicious plugin configurations if they include script detection rules.

Why prioritize this

Although this is a MEDIUM severity vulnerability (CVSS 4.4), prioritize it based on: (1) whether your WordPress deployment falls into the affected categories (multisite or unfiltered_html disabled), (2) the sensitivity of data accessible through pages that might contain the injected scripts, and (3) your trust level in current administrator accounts. If you run a standard single-site WordPress installation with default settings, this is low priority. If you operate a multisite network, treating this as near-term (within 2–4 weeks) is appropriate.

Risk score, explained

The CVSS 3.1 score of 4.4 reflects: Network attack vector (AV:N) due to remote accessibility of WordPress admin; High access complexity (AC:H) and High privilege requirement (PR:H) limiting exploitability to authenticated administrators; Changed scope (S:C) because the XSS executes in end-user browsers outside the plugin's immediate containment; and Low confidentiality and integrity impact (C:L/I:L) from script injection. No availability impact (A:N) is assigned. The score would be higher if the vulnerability were exploitable without authentication or affected standard WordPress configurations.

Frequently asked questions