The Team Members plugin for WordPress contains an input sanitization flaw that allows stored XSS through the first and last name fields. Authenticated users with Contributor or higher roles can inject arbitrary scripts that are then served to any visitor of the impacted page, enabling session hijacking, malicious content injection, or credential theft.

The vulnerable product is the Team Members WordPress plugin by spwebguy. All releases up to and including 5.3.5 are affected; WordPress sites that permit contributors or more privileged users to edit team member entries are exposed.

With a CVSS score of 6.4, the vulnerability has a moderate severity ranking, while the EPSS score of less than 1 % indicates a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The likely attack vector requires authenticated access to the WordPress dashboard and authorization to edit team member data; once a malicious script is stored, any visitor to the crafted page will execute the code.