Stored Cross-Site Scripting Vulnerability in Team Members Plugin by WordPress

CVE-2026-12114

What is CVE-2026-12114?

The Team Members – Multi Language Supported Team Plugin for WordPress is susceptible to a Stored Cross-Site Scripting flaw through its administrative settings. This vulnerability arises from inadequate input sanitization and output escaping, enabling authenticated attackers with administrator-level permissions to insert malicious web scripts into pages. These scripts execute whenever a user accesses a page that has been compromised. The issue specifically impacts multi-site setups and instances where unfiltered HTML is disabled, highlighting the importance of maintaining security best practices in plugin configurations.

References