CVE-2026-102402: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in techlabpro1 Team – Team Members Showcase Plugin

CVE-2026-102402 is a stored cross-site scripting vulnerability in the Team – Team Members Showcase Plugin for WordPress. The issue is due to insufficient input sanitization and output escaping of the 'ttp_filter_taxonomy' parameter, which is a meta field of an attacker-chosen post. Authenticated attackers with contributor-level privileges or higher can exploit this to inject arbitrary web scripts that execute in the context of users viewing the injected pages. This vulnerability affects all plugin versions from 0 up to and including 6.0.2.

Successful exploitation allows an authenticated contributor or higher to inject malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to partial confidentiality and integrity loss, such as theft of user credentials or session tokens, but does not affect availability. The vulnerability requires authenticated access, limiting the attack surface to users with contributor or higher privileges.

No official patch or fix has been explicitly stated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the plugin if possible. Monitor vendor communications for updates regarding patches or official mitigations.