Team Showcase EUVD-2025-209926

The attacker must hold an authenticated WordPress account with at minimum low-level privileges (confirmed by PR:L in the CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C vector) - unauthenticated exploitation is not possible. Additionally, a separate victim user must actively load the page containing the injected team showcase content (UI:R), meaning fully automated mass exploitation is not feasible per SSVC 'Automatable: no'. Sites where no external or untrusted users have WordPress account access (contributor role or above) are not exploitable under realistic conditions. The vulnerability is limited to installations running Team Showcase plugin versions 1.22.28 and earlier.

The CVSS 6.5 base score reflects a medium-severity issue with network delivery (AV:N), low complexity (AC:L), but constrained by low-privilege authentication requirement (PR:L) and mandatory user interaction (UI:R). Real-world risk is heavily site-context-dependent: organizations where untrusted external parties hold WordPress contributor or editor roles face meaningful exposure, while sites with tightly controlled user roles are effectively insulated. EPSS at 0.03% (10th percentile) and SSVC exploitation status of 'none' both reinforce that no widespread or automated exploitation is occurring. The 'Automatable: no' SSVC determination aligns with UI:R - the attack cannot be fully automated because a victim must actively navigate to the compromised page. Overall, this is a low-urgency issue for most deployments but a genuine remediation priority for multi-author WordPress sites with less-trusted contributor accounts.

An attacker with a low-privileged WordPress account (such as contributor or editor) injects a JavaScript payload - for example, a cookie-harvesting script - into a team member profile field managed by the plugin. When an administrator reviews the team showcase page or a site visitor browses it, the stored script executes silently in their browser, potentially exfiltrating session tokens to an attacker-controlled endpoint or performing authenticated actions on the victim's behalf. No public proof-of-concept exploit has been identified, but the attack pattern is well-understood and straightforward to execute manually.