Vulnerabilities and security researches forwps-team wps-team

Jun 07, 2024

CVE, Research URL: a5114dd9802b1d5676e2152ac8a3d619ab269b38
Home page URL: Security reports for Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder
Application: Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder
Date: Jul 18, 2023
Research Description: Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder [wps-team] < 2.8.3 WordPress Team Members â Best WordPress Team Plugin with Live Team Builder Plugin < 2.8.3 is vulnerable to Cross Site Scripting (XSS) Update the plugin to the latest version. Rafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Team Members â Best WordPress Team Plugin with Live Team Builder Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.8.3.
Affected versions: max 2.8.3.
Status: vulnerable

Apr 19, 2025

CVE, Research URL: CVE-2025-32686
Home page URL: Security reports for Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder
Application: Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder
Date: Apr 17, 2025
Research Description: Deserialization of Untrusted Data vulnerability in WPSpeedo Team Members wps-team allows Object Injection.This issue affects Team Members: from n/a through <= 3.4.4.
Affected versions: max 3.4.5.
Status: vulnerable

May 05, 2025

CVE, Research URL: CVE-2025-3521
Home page URL: Security reports for Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder
Application: Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder
Date: May 01, 2025
Research Description: The Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social Link icons in all versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 3.4.2.
Status: vulnerable

Dec 11, 2025

CVE, Research URL: CVE-2025-11560
Home page URL: Security reports for Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder
Application: Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder
Date: Nov 12, 2025
Research Description: The Team Members Showcase WordPress plugin before 3.5.0 does not sanitize and escape a parameter before outputting it back in the page, leading to reflected cross-site scripting, which could be used against high-privilege users such as admins.
Affected versions: max 3.5.0.
Status: vulnerable

May 03, 2026

CVE, Research URL: CVE-2024-13362
Home page URL: Security reports for Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder
Application: Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder
Date: May 01, 2026
Research Description: Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions: max 3.3.2.
Status: vulnerable

Jun 14, 2026

CVE, Research URL: CVE-2023-33999
Home page URL: Security reports for Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder
Application: Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder
Date: Jun 11, 2026
Research Description: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPVibes WP Mail Log allows DOM-Based XSS. This issue affects WP Mail Log: from n/a through 1.0.2.
Affected versions: max 2.8.3.
Status: vulnerable