The Employee Spotlight – Team Member Showcase & Meet the Team plugin for WordPress is vulnerable to Stored XSS because it fails to properly sanitize and escape data entered in the social URL fields. This weakness, identified as CWE‑79, allows an attacker to embed malicious scripts that will run in the web browsers of any user who views the affected page, potentially leading to defacement, cookie theft, or session hijacking.

The vulnerability affects the WordPress plugin "Employee Spotlight – Team Member Showcase & Meet the Team" provided by emarket‑design. All plugin versions up to and including 5.1.2 are impacted. An authenticated attacker with Contributor level or higher can perform the exploit.

The CVSS score of 6.4 reflects a moderate risk of exploitation. Because the EPSS score is below 1% and the vulnerability is not listed in CISA KEV, the likelihood of widespread immediate exploitation is low, but the attack requires legitimate contributor credentials. Once a malicious script is injected, it executes with the privileges of the browsing user, potentially compromising confidentiality, integrity, and availability of site content.