The AMO Team Showcase plugin for WordPress allows authenticated users with contributor or higher privileges to insert arbitrary JavaScript into the page via the amoteam_skills shortcode. Because the plugin fails to properly sanitize or escape user‑supplied attributes, the injected script is persisted and executed for every visitor to the affected content. This is a classic stored XSS flaw that permits attackers to modify page content, steal session cookies, or execute other malicious actions within the user's browser context.

WordPress sites running the AMO Team Showcase plugin, versions up to and including 1.1.4, are affected. The flaw resides in the amoteam_skills shortcode component of the AMO Team Showcase plugin.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is below 1 %, suggesting a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. It can be exploited only by authenticated users with contributor-level access or higher, so the attack vector is restricted to internal or compromised credentials rather than public. Because the payload is user‑controlled and stored, it remains active until the offending content is removed or the plugin is patched.