Vulnerabilities and security researches forteam-showcase-supreme team-showcase-supreme

Jun 07, 2024

CVE, Research URL: CVE-2023-23647
Home page URL: Security reports for Team Member – Multi Language Supported Team Plugin
Application: Team Member – Multi Language Supported Team Plugin
Date: May 09, 2023
Research Description: Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in Sk. Abul Hasan Team Member – Team with Slider plugin <= 4.4 versions.
Affected versions: max 4.5.
Status: vulnerable

Nov 15, 2024

CVE, Research URL: CVE-2024-52385
Home page URL: Security reports for Team Member – Multi Language Supported Team Plugin
Application: Team Member – Multi Language Supported Team Plugin
Date: Dec 09, 2024
Research Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpmart Team Member team-showcase-supreme.This issue affects Team Member: from n/a through <= 7.4.
Affected versions: max 7.5.
Status: vulnerable

May 09, 2026

CVE, Research URL: CVE-2025-68060
Home page URL: Security reports for Team Member – Multi Language Supported Team Plugin
Application: Team Member – Multi Language Supported Team Plugin
Date: May 07, 2026
Research Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPMart Team Member allows Blind SQL Injection. This issue affects Team Member: from n/a through 8.5.
Affected versions: max 8.6.
Status: vulnerable

Jul 01, 2026

CVE, Research URL: CVE-2026-12114
Home page URL: Security reports for Team Member – Multi Language Supported Team Plugin
Application: Team Member – Multi Language Supported Team Plugin
Date: Jun 30, 2026
Research Description: The Team Members – Multi Language Supported Team Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Affected versions: max 8.8.
Status: vulnerable

Sep 28, 2026

CVE, Research URL: CVE-2026-11871
Home page URL: Security reports for Team Member – Multi Language Supported Team Plugin
Application: Team Member – Multi Language Supported Team Plugin
Date: Sep 26, 2026
Research Description: The Team Members WordPress plugin through 9.2 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly.
Affected versions: max 9.2.
Status: vulnerable