Team Members Showcase EUVD-2026-96212

Exploitation requires an authenticated account with contributor-level privileges or above on the target WordPress site, and the attacker must be able to supply the 'ttp_filter_taxonomy' taxonomy-meta value on an attacker-chosen post that is rendered through the Team - Team Members Showcase plugin's shortcode (Shortcode.php). The payload only executes when a user subsequently views the page containing the injected taxonomy filter output. Limiting factors: no anonymous/unauthenticated path (PR:L), so sites that do not permit untrusted contributor registration sharply reduce exposure; impact depends on a victim actually loading the affected plugin-rendered page, and is confined to the browser context (no direct server compromise).

This is a moderate-severity stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reported by Wordfence. The CVSS vector indicates a network-reachable, low-complexity flaw, but PR:L confirms it is NOT unauthenticated - an attacker needs at least contributor-level credentials on the target WordPress site, which materially lowers real-world risk since contributor accounts are not universally granted to untrusted parties. There is no CISA KEV listing and no EPSS score provided, and no public exploit was referenced, so there is no public exploit identified at time of analysis. The scope change (S:C) and limited-to-low confidentiality/integrity impacts reflect classic stored-XSS behavior: script executes in the browser of whoever views the injected page (often an administrator), crossing a security boundary. Net assessment: a genuine but lower-tier priority - not a mass-exploitable unauthenticated bug. The main gating factor is the requirement for a pre-existing contributor+ account; sites that allow open/self-service contributor registration face meaningfully higher risk. No conflicting signals are present in the supplied data, though EPSS and POC status are simply absent rather than contradictory.

An attacker who already holds a contributor-level (or higher) account on the WordPress site creates or edits a post and injects a malicious script payload through the 'ttp_filter_taxonomy' meta parameter consumed by the plugin's shortcode. When an administrator or other visitor later renders a page displaying that team/taxonomy content, the stored script executes in their browser, enabling session/cookie theft or actions in the victim's authenticated context. No public exploit code was referenced in the provided intelligence.