The plugin contains an improper neutralization of input during web page generation, leading to stored cross‑site scripting. An attacker can embed malicious scripts that will be executed in the browsers of any visitor who views the affected content. This can result in session hijacking, credential theft, defacement, or other actions performed on behalf of the victim. The weakness is identified as CWE‑79.

HT Plugins’ HT Team Member plugin is affected for all releases through version 1.1.7. Sites deploying the plugin on WordPress without updating beyond this version are vulnerable.

The CVSS score of 6.5 indicates a moderate severity vulnerability. The EPSS score of less than 1 % suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The stored XSS could be triggered when an attacker supplies malicious input via an administrative interface or any input form that the plugin persists and later displays; therefore, the attack vector is inferred to be remote through the web portal, though specifics depend on the site's configuration.