CVE-2025-8440

MediumCVSS 6.4

Published: 27/09/2025(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

Risk Assessment

An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts into pages that execute whenever a user accesses an injected page.

Recommendation

Update the Team Members plugin to a version newer than 5.3.5 or disable it if no update is available.

Other vulnerabilities in Team Members WordPress plugin

CVE-2026-11871Medium
The Team Members WordPress plugin before 9.3 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly.

Original NVD description (English source)

The Team Members plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the first and last name fields in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS