Threat Entry Updated 2026-01-08

CVE-2025-14124 - Team Plugin

The Team WordPress plugin before 5.0.11 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

PLUGIN Team

CVE-2025-14124

HIGH CVSS 8.6 2026-01-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-06-12

CVE-2024-9236 - Team Plugin

The Team WordPress plugin before 4.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

PLUGIN Team

CVE-2024-9236

MEDIUM CVSS 4.8 2025-05-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-02-24

CVE-2024-13439 - Team Plugin

The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the response() function in all versions up to, and including, 4.4.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings.

PLUGIN Team

CVE-2024-13439

MEDIUM CVSS 4.3 2025-02-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2022-2557 - Team Plugin

The Team WordPress plugin before 4.1.2 contains a file which could allow any authenticated users to download arbitrary files from the server via a path traversal vector. Furthermore, the file will also be deleted after its content is returned to the user

PLUGIN Team

CVE-2022-2557

HIGH CVSS 8.8 2022-08-22

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2022-34853 - Team Plugin

Multiple Authenticated (contributor or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin

PLUGIN Team

CVE-2022-34853

MEDIUM CVSS 4.1 2022-07-22

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2022-34650 - Team Plugin

Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin

PLUGIN Team

CVE-2022-34650

MEDIUM CVSS 4.1 2022-07-22

Risk Score

Open Full Technical Breakdown