The Team Members Showcase plugin for WordPress suffers from a stored XSS vulnerability (CWE-80) due to improper neutralization of script-related HTML tags in the Social Link icons feature. Authenticated users with Contributor-level privileges or higher can inject arbitrary JavaScript that executes in the context of other users viewing the injected pages. This vulnerability affects all versions up to and including 3.4.1. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required, no user interaction, scope change, and low impact on confidentiality and integrity, with no impact on availability. No patch or official remediation is currently referenced.

Successful exploitation allows an authenticated user with Contributor or higher privileges to inject persistent malicious scripts into pages via Social Link icons. These scripts execute in the browsers of other users who visit the affected pages, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability does not affect availability and has low impact on confidentiality and integrity. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit Contributor-level access to trusted users only and consider disabling or restricting the use of Social Link icons in the plugin. Monitor for updates from the vendor or security advisories for an official patch or mitigation.