BaseFortify

Publication date: 2025-11-12

Last updated on: 2025-11-13

Assigner: WPScan

Description

The Team Members Showcase WordPress plugin before 3.5.0 does not sanitize and escape a parameter before outputting it back in the page, leading to reflected cross-site scripting, which could be used against high-privilege users such as admins.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-12

Last Modified

2025-11-13

Generated

2026-07-06

AI Q&A

2025-11-12

EPSS Evaluated

2026-07-05

NVD

CVE-2025-11560

Affected Vendors & Products

Vendor	Product	Version / Range
wordpress	team_members_showcase	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Team Members Showcase WordPress plugin before version 3.5.0. It occurs because the plugin does not properly sanitize and escape a parameter before outputting it back on the page. This flaw allows for reflected cross-site scripting (XSS) attacks, where malicious scripts can be injected and executed in the context of the affected website.

Impact Analysis

The vulnerability can be exploited to perform reflected cross-site scripting attacks, potentially targeting high-privilege users such as administrators. This could lead to unauthorized actions being performed on behalf of these users, theft of sensitive information, session hijacking, or other malicious activities that compromise the security and integrity of the affected website.

Hi! I’m here to help you understand CVE-2025-11560. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70