CVE-2026-12114 Overview
CVE-2026-12114 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Team Members – Multi Language Supported Team Plugin for WordPress. All versions up to and including 8.7 are affected. The flaw results from insufficient input sanitization and output escaping in the plugin's admin settings. Authenticated attackers with administrator-level permissions or higher can inject arbitrary web scripts that execute when users access affected pages.
Critical Impact
The vulnerability enables persistent script injection in WordPress pages, but exploitation is restricted to multi-site installations and environments where unfiltered_html has been disabled.
Affected Products
- Team Members – Multi Language Supported Team Plugin for WordPress (versions ≤ 8.7)
- WordPress multi-site installations running the affected plugin
- WordPress installations where the unfiltered_html capability is disabled
Discovery Timeline
- 2026-06-30 - CVE-2026-12114 published to NVD
- 2026-06-30 - Last updated in NVD database
Technical Details for CVE-2026-12114
Vulnerability Analysis
The vulnerability resides in the plugin's slider settings save routine and shortcode rendering logic. The affected code paths are located in settings/helper/slider_form_save.php at lines 529 and 531, and in shortcode.php at line 200. These paths accept administrator-supplied input and render it back into pages without adequate sanitization or output escaping.
Because the injected payload is stored in the plugin's persistent configuration, the script executes for every visitor who loads a page containing the affected shortcode. The attack requires an authenticated administrator session, which limits the practical attack surface to insider threats, compromised admin credentials, or scenarios where lower-privileged roles cannot post raw HTML due to unfiltered_html restrictions.
Root Cause
The plugin trusts administrator input by design. On WordPress single-site installations, administrators typically retain the unfiltered_html capability, making the storage of HTML and JavaScript expected behavior. On multi-site networks, only super administrators hold unfiltered_html by default, so a regular site administrator submitting scripts through the plugin bypasses WordPress's intended content boundary. The plugin fails to apply functions such as wp_kses_post() on save or esc_html() and esc_attr() on output.
Attack Vector
An attacker with administrator access on a WordPress multi-site network navigates to the plugin's slider configuration page and submits a payload in a vulnerable field. The payload is written to the database through the save handler in slider_form_save.php. When any user renders a page containing the plugin's shortcode, the payload is emitted into the response body by shortcode.php, executing in the visitor's browser under the site's origin. This allows session theft, forced administrative actions, and drive-by redirection.
Detection Methods for CVE-2026-12114
Indicators of Compromise
- Unexpected <script>, onerror, or onload attributes stored in the wp_options or plugin-specific tables holding Team Showcase Supreme configuration
- Outbound requests from visitor browsers to attacker-controlled domains sourced from pages containing the plugin's shortcode
- Administrator account activity modifying slider settings from unfamiliar IP addresses or during unusual hours
Detection Strategies
- Audit database entries associated with team-showcase-supreme for HTML event handlers or javascript: URIs
- Review WordPress audit logs for options.php or plugin settings updates immediately followed by changes to public-facing pages
- Perform DOM inspection on pages that embed the plugin's shortcode to identify script tags not present in the theme or core content
Monitoring Recommendations
- Enable WordPress activity logging plugins to track administrator setting changes across all network sites
- Deploy Content Security Policy (CSP) headers in report-only mode to surface unexpected inline script execution
- Monitor web server access logs for anomalous referrers originating from pages known to render the plugin
How to Mitigate CVE-2026-12114
Immediate Actions Required
- Update the Team Members – Multi Language Supported Team Plugin to a version newer than 8.7 once the vendor publishes a fix
- Review all administrator accounts on multi-site networks and revoke access for accounts that do not require slider configuration privileges
- Inspect existing plugin configurations and remove any stored HTML or JavaScript payloads before restoring the plugin to service
Patch Information
Refer to the WordPress Changeset Review and the Wordfence Vulnerability Report for the current remediation status and version details.
Workarounds
- Restrict plugin configuration access to trusted super administrators only on multi-site deployments
- Re-enable the unfiltered_html capability for site administrators only when strictly necessary and after weighing the associated risks
- Deploy a strict Content Security Policy that disallows inline scripts on public pages containing the plugin's shortcode
- Deactivate the plugin on multi-site networks until a patched release is confirmed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
