Team Members <= 8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_css' Parameter

Summary

The Team Members – Multi Language Supported Team Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Timeline

1. Jun 30, 2026, 2:30 AM UTCCVE published
2. Jun 30, 2026, 2:20 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Jun 30, 2026, 3:59 PM UTCRecord last updated

Affected versions

• wpmart Team Members – Multi Language Supported Team Plugin

  through 8.7

References 8