Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Team Showcase team-showcase allows Stored XSS.This issue affects Team Showcase: from n/a through <= 2.9.
Published: 2026-01-06
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting in the WordPress Team Showcase plugin
Action: Apply Patch
AI Analysis

Impact

The vulnerability is a stored cross‑site scripting (XSS) flaw that originates from improper neutralization of input during web page generation. Attackers can inject malicious scripts that are saved to the database and executed when other users view pages that display the data. The weakness is classified as CWE‑79.

Affected Systems

The Team Showcase plugin by Themepoints, with affected releases from the initial version through version 2.9, frames WordPress sites that use the plugin.

Risk and Exploitability

With a CVSS score of 6.5 the flaw presents moderate‑to‑high severity. The EPSS score of less than 1% indicates a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the most likely attack vector is through submittable fields within the plugin that store input without proper sanitization, allowing an attacker to inject code that runs in the browsers of site visitors.

Generated by OpenCVE AI on April 28, 2026 at 10:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Team Showcase plugin to the latest published version.
  • If an update is not available, deactivate or uninstall the plugin to remove the vulnerability from the site.
  • Ensure that any data output by the plugin is escaped or sanitized using WordPress core functions such as wp_kses().

Generated by OpenCVE AI on April 28, 2026 at 10:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Tue, 20 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
References

Wed, 07 Jan 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Wed, 07 Jan 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Themepoints
Themepoints team Showcase
Wordpress
Wordpress wordpress
Vendors & Products Themepoints
Themepoints team Showcase
Wordpress
Wordpress wordpress

Tue, 06 Jan 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Jan 2026 16:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Team Showcase team-showcase allows Stored XSS.This issue affects Team Showcase: from n/a through <= 2.9.
Title WordPress Team Showcase plugin <= 2.9 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References

Subscriptions

Themepoints Team Showcase
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:14:37.807Z

Reserved: 2025-12-31T20:12:23.433Z

Link: CVE-2025-69335

cve-icon Vulnrichment

Updated: 2026-01-06T16:55:44.690Z

cve-icon NVD

Status : Deferred

Published: 2026-01-06T17:15:46.323

Modified: 2026-04-27T21:16:24.160

Link: CVE-2025-69335

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T10:15:28Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')