CVE-2026-12114 is a stored cross-site scripting vulnerability in the Team Members – Multi Language Supported Team Plugin for WordPress. The flaw exists due to improper neutralization of input during web page generation, allowing authenticated administrators to inject malicious scripts via the plugin's admin settings. These scripts execute when users visit the injected pages. The vulnerability affects all plugin versions up to and including 8.7 and is limited to multi-site WordPress installations or setups where unfiltered_html is disabled. No official patch or remediation level has been provided as of the publication date.

An attacker with administrator-level privileges can inject arbitrary web scripts that execute in the context of users visiting the affected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of users. The vulnerability does not impact availability. The scope is limited to multi-site installations or those with unfiltered_html disabled, reducing the overall attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or limiting the use of the affected plugin in multi-site environments or where unfiltered_html is disabled. Monitor vendor channels for updates or patches addressing this vulnerability.