WordPress Plugin Vulnerabilities

Team Members < 3.4.2 - Contributor+ Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting via Social Link icons due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
wps-team
Fixed in 3.4.2

References

CVE
CVE-2025-3521
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/93b83e65-09d6-4ad5-85f3-d18a9a35f39d

Classification

Type
CROSS FRAME SCRIPTING
OWASP top 10
A1: Injection
CWE
CWE-80
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
siavashvafshar
Verified
No
WPVDB ID
5438243b-1415-4367-b281-63c283a95230

Timeline

Publicly Published
2025-04-30 (about 1 year ago)
Added
2025-04-30 (about 1 year ago)
Last Updated
2025-11-27 (about 5 months ago)

Other

Published
Title
Published
2025-10-08
Title
Cookie Notice & Consent < 1.6.6 - Unauthenticated Stored Cross-Site Scripting
Published
2026-03-30
Title
Ibtana - WordPress Website Builder < 1.2.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2024-12-05
Title
ARForms Form Builder < 1.7.2 - HTML Injection
Published
2025-10-02
Title
Yoast SEO Premium 25.7-25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-01-19
Title
FileBird < 5.6.1 - Admin+ Stored XSS