CVE-2025-8440 is a stored cross-site scripting vulnerability in the Team Members WordPress plugin by spwebguy, affecting all versions up to and including 5.3.5. The vulnerability allows authenticated users with Contributor or higher privileges to inject arbitrary web scripts via the first and last name input fields. This occurs due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of user-supplied data. The vulnerability can lead to script execution in the context of other users viewing the injected pages. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, and partial confidentiality and integrity impact without availability impact. No patch or remediation details are currently provided.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages generated by the plugin, which execute in the browsers of users who view those pages. This can lead to partial compromise of confidentiality and integrity of user data or session information. There is no indication of availability impact. The vulnerability requires authentication but no user interaction beyond viewing the injected page. No known exploits are reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider removing or disabling the Team Members plugin if possible. Monitor vendor channels for updates and apply patches promptly once available.