What is the CVSS score of EUVD-2026-40249?

EUVD-2026-40249 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Team Members Plugin EUVD-2026-40249

| CVE-2026-12114 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-30 Wordfence

GHSA-xwjg-85ph-66cc

WordPress XSS Wordpress Plugin Team Members Multi Language Supported Team Plugin Wpmart

4.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

4.0 MEDIUM

PR:H for required admin credentials, AC:H for non-default multisite or unfiltered_html-disabled configuration, UI:R because a victim must visit the injected page for any impact to occur.

3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 03:13 vuln.today

CVE Published

Jun 30, 2026 - 02:30 cve.org

MEDIUM 4.4

DescriptionCVE.org

The Team Members - Multi Language Supported Team Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

AnalysisAI

Persistent script injection in the Team Members - Multi Language Supported Team Plugin for WordPress (all versions through 8.7) enables authenticated administrators to embed malicious JavaScript into site pages via insufficient sanitization and escaping in admin settings fields, with injected payloads executing silently for every subsequent page visitor. The vulnerability is constrained to two non-default deployment scenarios: WordPress multisite network installations and single-site installations where the unfiltered_html capability has been explicitly revoked from administrators - standard single-site installs are unaffected. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept exists, placing real-world risk well below what the scope-changed CVSS vector might initially suggest.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) describes the root cause: the plugin accepts administrator-supplied data through settings forms and writes it to the WordPress database without adequate sanitization, then renders that stored data into page output without output escaping. The specific vulnerable code paths are pinpointed by Trac browser references in both the 8.6 and 8.7 release tags: shortcode.php at line 200 (the rendering/output side) and settings/helper/slider_form_save.php at lines 529 and 531 (the save/storage side). WordPress normally grants administrators the unfiltered_html capability, which allows raw HTML/JavaScript to pass through WordPress core unmodified regardless of plugin-level sanitization failures. The vulnerability surface only opens when this capability is removed - a common hardening step in multisite networks and enterprise WordPress deployments - because that removal causes WordPress to route admin input through sanitization functions that the plugin fails to correctly complement with output escaping. CPE cpe:2.3:a:wpmart:team_members_-_multi_language_supported_team_plugin:*:*:*:*:*:*:*:* identifies the affected vendor (wpmart) and plugin (WordPress repository slug: team-showcase-supreme).

RemediationAI

A fix has been committed to the WordPress plugin repository as changeset 3580341 (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3580341%40team-showcase-supreme&new=3580341%40team-showcase-supreme); however, a specific released version number for the patched build is not independently confirmed from the available data - site owners should update to the latest version available in the WordPress plugin directory and verify the installed version exceeds 8.7. As a compensating control pending upgrade, WordPress multisite network administrators should audit and restrict the assignment of administrator-level roles to fully trusted accounts only, minimizing the population of users who could exploit the settings-side vulnerability. Alternatively, if the organizational security policy permits it, re-enabling unfiltered_html for administrator-tier users eliminates the specific configuration condition that exposes this flaw, though this trade-off reintroduces the general risk of unfiltered HTML from admins across the entire installation. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ccf00ec5-b91a-47db-81e6-68f984b8f06b for confirmation of the patched release version.