The reported vulnerability is a stored Cross‑Site Scripting (XSS) flaw in the Ibnul H. Custom Team Manager plugin for WordPress. Improperly sanitized user input is rendered in web pages, allowing an attacker to inject arbitrary JavaScript that is executed when others view affected pages. The stored nature of the flaw means the malicious payload persists in the database, enabling repeat exploitation against any visitor who accesses the compromised content.

Any WordPress installation running the Custom Team Manager plugin version 2.4.2 or earlier is affected. Sites that have not upgraded beyond version 2.4.2 and continue using the plugin are at risk.

The CVSS score of 6.5 denotes moderate severity. The EPSS score is below 1 %, indicating a low likelihood of exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need web access to the site and the ability to submit content through the plugin’s input fields; the stored XSS payload would then execute automatically in the browsers of other visitors, potentially leading to session hijacking, credential theft, or defacement. No external authentication is required beyond legitimate plugin use, and the flaw does not require privileged escalation.