CVE-2026-102402 in The Team Plugin
Summary
by MITRE • 10/10/2026
The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttp_filter_taxonomy (meta of the attacker-chosen post)' parameter in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The Team – Team Members Showcase Plugin for WordPress contains a critical security flaw identified as a Stored Cross-Site Scripting vulnerability within the ttp_filter_taxonomy parameter. This issue persists across all versions up to and including 6.0.2, stemming from insufficient input sanitization and output escaping mechanisms during data processing. The core technical failure lies in the application's handling of user-supplied content associated with taxonomy metadata for posts created or modified by authenticated users. When an attacker injects malicious JavaScript payloads into this specific field, the system fails to properly encode or validate the input before storing it in the database and subsequently rendering it on public-facing pages without adequate sanitization checks during output generation.
This vulnerability allows attackers who possess contributor-level access or higher privileges within the WordPress environment to persistently embed arbitrary web scripts directly into post content. Unlike reflected XSS, where malicious code is executed only when a victim clicks a specially crafted link, stored XSS ensures that the payload remains on the server and executes automatically whenever any user views the compromised page. This persistence significantly amplifies the risk profile, as the attack does not require social engineering to trigger execution beyond initial access; it becomes an inherent part of the website's content delivery mechanism affecting all subsequent visitors who load the affected pages.
The operational impact of this vulnerability is severe, potentially leading to complete compromise of user sessions and sensitive data exposure. Attackers can exploit the executed scripts to steal administrative cookies or session tokens, thereby hijacking active user sessions and gaining unauthorized access to privileged accounts. Furthermore, malicious actors may redirect users to phishing sites designed to harvest credentials, deface websites by altering displayed content, or deploy further malware onto visitors' devices through drive-by download techniques. The ability to execute arbitrary code in the context of the victim's browser also enables keylogging capabilities, allowing attackers to capture sensitive information such as login details and personal data entered into forms on the compromised site.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The attack vector corresponds to ATT&CK technique T1059, specifically Command and Scripting Interpretation via JavaScript execution within the browser environment. Additionally, because it requires authentication at a specific privilege level before exploitation is possible, it relates to CWE-269 regarding Improper Privilege Management, highlighting that even lower-level accounts can cause significant damage due to inadequate validation controls on stored data fields.
To mitigate this vulnerability, immediate action must be taken by upgrading the Team – Team Members Showcase Plugin to a version newer than 6.0.2 where these sanitization and escaping issues have been addressed by the developers. Until an update is available or if patching is not immediately feasible, administrators should restrict contributor-level access to trusted individuals only and consider implementing Web Application Firewall rules that detect and block common XSS payloads in post metadata fields. Regular security audits and code reviews focusing on input validation and output encoding practices are essential for preventing similar flaws in future plugin updates or custom developments within the WordPress ecosystem.