CVE-2026-12114 is a stored cross-site scripting vulnerability (CWE-79) in the Team Members – Multi Language Supported Team Plugin for WordPress. The flaw exists due to improper neutralization of input during web page generation, specifically in admin settings. Authenticated attackers with administrator privileges can inject arbitrary web scripts that execute in the context of users visiting the injected pages. This vulnerability affects multi-site WordPress installations and those with unfiltered_html disabled, impacting all plugin versions up to and including 8.7. There is no official patch or remediation level provided by the vendor as of the publication date.

An attacker with administrator-level permissions can exploit this vulnerability to inject malicious scripts that execute in users' browsers when they view the affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of session tokens or manipulation of page content. The vulnerability does not affect availability. The attack complexity is high due to the need for administrator privileges and specific installation conditions (multi-site or unfiltered_html disabled).

No official fix or patch is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Mitigation includes restricting administrator access to trusted users only and considering disabling or limiting the use of the affected plugin in multi-site environments or where unfiltered_html is disabled. Since the vulnerability requires administrator privileges, enforcing strict access controls reduces risk.