Team Members < 5.2.1 – Editor+ Stored XSS | CVE 2022-3936 | Plugin Vulnerabilities

Description

The plugin does not sanitize and escapes some of its settings, which could allow high-privilege users such as editors to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in a multisite setup).

Proof of Concept

1. Go to the "Teams" section » add a new team and in the "Main color" option, add the payload: " onmouseover=alert(/XSS/)//
2. Publish/Update the page » click on the "Main color" option and hover the mouse over the input field to trigger the XSS.

Affects Plugins

Fixed in 5.2.1

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

lucy

Submitter

lucy

Verified

Yes

WPVDB ID

921daea1-a06d-4310-8bd9-4db32605e500

Timeline

Publicly Published

2022-12-09 (about 3 years ago)

Added

2022-12-08 (about 3 years ago)

Last Updated

2022-12-08 (about 3 years ago)

Other

Published

Title

Published

2025-10-24

Title

Listeo < 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via soundcloud Shortcode

Published

2025-07-29

Title

MetForm < 4.0.2 - Contributor+ Stored XSS via mf-template DOM Element

Published

2015-04-16

Title

FooBox Image Lightbox <= 1.0.4 - Cross-Site Scripting (XSS)

Published

2023-03-06

Title

Complianz - GDPR/CCPA Cookie Consent < 6.4.2 - Contributor+ Stored XSS

Published

2024-08-16

Title

Modal Window < 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting