The Team Showcase plugin for WordPress suffers a stored cross‑site scripting flaw that permits malicious JavaScript to be injected into pages generated by the plugin. This vulnerability stems from improper neutralization of input, as identified by CWE‑79, and could allow an attacker to hijack user sessions, deface content, or deploy phishing payloads. The impact is a complete compromise of client‑side confidentiality and integrity for any user who views affected content.

Affecting the PickPlugins Team Showcase plugin, all releases from its initial deployment through version 1.22.28 are vulnerable. Users running these versions on WordPress sites are exposed; the issue does not affect other plugins or WordPress core components.

With a CVSS score of 6.5 the flaw presents a medium‑to‑high risk level, and its EPSS score is not currently available. The vulnerability is not listed in the CISA KEV catalog, reducing the chance of known widespread exploitation. The attack likely requires that an attacker can submit or modify content through the plugin’s interface, which may be restricted to administrators or contributors. Once injected, the script executes in the browser context of every user who loads the affected pages.