Team Team Members Showcase Plugin
Monthly
Stored cross-site scripting in the WordPress plugin Team - Team Members Showcase (slug 'tlp-team', vendor techlabpro1) affects all versions up to and including 6.0.2 and lets authenticated attackers with contributor-level privileges or above persist arbitrary JavaScript via the 'ttp_filter_taxonomy' taxonomy-meta value of an attacker-chosen post. The script then executes in the browser of any user - including higher-privileged users such as editors or administrators - who views a page where the plugin's shortcode renders that taxonomy filter output, giving a CVSS 6.4 impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No public exploit identified at time of analysis, and there is no CISA KEV confirmation of active exploitation, so risk is concentrated on sites that grant contributor access to untrusted users; there is no unauthenticated path (PR:L).
Stored cross-site scripting in the WordPress plugin Team - Team Members Showcase (slug 'tlp-team', vendor techlabpro1) affects all versions up to and including 6.0.2 and lets authenticated attackers with contributor-level privileges or above persist arbitrary JavaScript via the 'ttp_filter_taxonomy' taxonomy-meta value of an attacker-chosen post. The script then executes in the browser of any user - including higher-privileged users such as editors or administrators - who views a page where the plugin's shortcode renders that taxonomy filter output, giving a CVSS 6.4 impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No public exploit identified at time of analysis, and there is no CISA KEV confirmation of active exploitation, so risk is concentrated on sites that grant contributor access to untrusted users; there is no unauthenticated path (PR:L).