Stored Cross-Site Scripting Vulnerability in Team Members Plugin for WordPress
CVE-2025-8440
6.4MEDIUM
What is CVE-2025-8440?
The Team Members plugin for WordPress is affected by a stored cross-site scripting vulnerability, allowing authenticated attackers with Contributor-level access or higher to exploit insufficient input sanitization and output escaping in the first and last name fields. This enables the injection of arbitrary web scripts that execute whenever users visit the compromised pages, potentially leading to data theft, session hijacking, or other malicious actions.
Affected Version(s)
Team Members * <= 5.3.5
References
CVSS V3.1
Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
D.Sim