Executive brief
The Team Master plugin for WordPress, which is used to display staff or team profiles on websites, contains a security flaw that allows users with contributor-level access or higher to inject malicious scripts into pages. When other users, including site administrators or visitors, view these pages, the malicious script will execute in their browser. This could lead to unauthorized actions being performed on behalf of the victim or the theft of sensitive session information.
Technical details
The Team Master plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on shortcode attributes. This vulnerability exists in all versions up to and including 1.1.2. An authenticated attacker with contributor-level permissions or higher can exploit this by embedding malicious web scripts within a shortcode. When a user views the affected page, the script executes in their browser context. This is classified as CWE-79 and carries a CVSS score of 6.4, reflecting the requirement for authentication but the potential for cross-site impact.
Affected products
- The Team Master The Team Master – A Modern WordPress Team Showcase Up to and including 1.1.2
Timeline
- 2026-05-27: disclosed: CVE published to the NVD dataset