The Team Members – Multi Language Supported Team Plugin contains an insufficient input sanitization flaw in the settings page that allows an authenticated administrator to inject arbitrary JavaScript code into the "custom_css" field. When the stored script is rendered on a page that includes the custom CSS block, it will execute in the browsers of all visitors to that page, compromising the integrity and confidentiality of the site. This type of vulnerability is categorized as CWE‑79 and is limited to stored Cross‑Site Scripting. The flaw is present only in versions up to and including 8.7 and requires that WordPress be deployed as a multi‑site network with the unfiltered_html capability disabled for nontrusted users.

The vulnerability affects installations of the Team Members plugin version 8.7 or earlier on WordPress multisite deployments. Users must have an administrative role or higher to exploit it; non‑administrator accounts cannot inject the payload. The plugin’s settings interface is the entry point for the malicious input and the shortcode that includes the custom CSS is the surface used to deliver the attack to other users.

With a CVSS score of 4.4 the risk is moderate; however, the EPSS score is unavailable, so the likelihood of real‑world exploitation is unclear. The vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation. The attack requires authenticated access with administrator privileges and a multisite environment where unfiltered_html is disabled. Attackers would modify the custom_css entry in the plugin settings, then wait for a user to view a page that renders the CSS. Because the payload is stored, it can be used for repeated, automated attacks once the exploit is inserted.