CVE-2025-3521

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3521", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-04-11T15:04:36.141Z", "datePublished": "2025-05-01T06:40:16.242Z", "dateUpdated": "2026-04-08T17:09:44.370Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:09:44.370Z"}, "affected": [{"vendor": "wpspeedo", "product": "Team Members Showcase", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.4.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Team Members \u2013 Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social Link icons in all versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Team Members \u2013 Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/93b83e65-09d6-4ad5-85f3-d18a9a35f39d?source=cve"}, {"url": "https://wordpress.org/plugins/wps-team/"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3286466%40wps-team&new=3286466%40wps-team&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "cweId": "CWE-80", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Siavash Vaez Afshar"}], "timeline": [{"time": "2025-04-30T18:14:23.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-01T16:07:58.937956Z", "id": "CVE-2025-3521", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-01T16:11:52.605Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3521", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-01T16:07:58.937956Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-01T16:08:11.063Z"}}], "cna": {"title": "Team Members \u2013 Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder <= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Siavash Vaez Afshar"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wpspeedo", "product": "Team Members \u2013 Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.4.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-04-30T18:14:23.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/93b83e65-09d6-4ad5-85f3-d18a9a35f39d?source=cve"}, {"url": "https://wordpress.org/plugins/wps-team/"}], "descriptions": [{"lang": "en", "value": "The Team Members \u2013 Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social Link icons in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-80", "description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-05-01T06:40:16.242Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3521", "state": "PUBLISHED", "dateUpdated": "2025-05-01T16:11:52.605Z", "dateReserved": "2025-04-11T15:04:36.141Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-05-01T06:40:16.242Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Team Members Showcase", "vendor": "wpspeedo", "versions": [{"lessThanOrEqual": "3.4.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Team Members \u2013 Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social Link icons in all versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Team Members \u2013 Best WordPress Team Plugin with Team Slider, Team Showcase &amp; Team Builder para WordPress con deslizador de equipo, escaparate de equipo y constructor de equipos es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s de iconos de enlaces sociales en todas las versiones hasta la 3.4.0 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-3521", "lastModified": "2026-06-17T09:20:06.237", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-3521", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-05-01T16:07:58.937956Z", "version": "2.0.3"}}]}, "published": "2025-05-01T07:15:58.223", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3286466%40wps-team&new=3286466%40wps-team&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/wps-team/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/93b83e65-09d6-4ad5-85f3-d18a9a35f39d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-80"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T21:01:56.344192+00:00", "value": {"mitigation_remediation": ["Upgrade the Team Members plugin to the latest available version (3.4.2 or later).", "If an upgrade is not yet possible, disable or remove the social link icon functionality for Contributor\u2011level users, or constrain Contributor users to read\u2011only roles.", "Apply a generic input\u2011sanitization filter or use a security plugin that ensures output is properly escaped for all custom fields."], "summary": {"action": "Update Plugin", "impact": "Stored Cross\u2011Site Scripting enabling script injection by authenticated contributors"}, "threat_synthesis": {"affected_systems": "The affected product is the wpspeedo Team Members Showcase plugin for WordPress, any installation using version 3.4.1 or earlier.", "description_and_impact": "The Team Members \u2013 Best WordPress Team Plugin is vulnerable to stored cross\u2011site scripting through the social link icon fields in all versions up to 3.4.1. The vulnerability results from insufficient input sanitization and lack of output escaping, allowing an authenticated user with a Contributor role or higher to embed arbitrary scripts. Once executed, these scripts run in the browsers of any visitor to the page containing the injected content, potentially leading to session hijacking, defacement, or data exfiltration.", "risk_and_exploitability": "The vulnerability has a CVSS score of 6.4 and an EPSS score of less than 1\u202f%, indicating moderate impact but low probability of exploitation. It is not listed in the CISA KEV catalog. The likely attack path requires the attacker to log in with Contributor or higher privileges, edit a social link icon entry, and then have an end user visit the modified page. Because the exploit requires authenticated access, the immediate risk to sites without Contributor accounts is lower, but once such accounts exist the risk increases."}}}}, "created": "2026-04-21T21:15:45.443908+00:00", "updated": "2026-04-21T21:15:45.443919+00:00", "vendors": []}