CVE-2026-8870: Stored XSS in WordPress Team Master Plugin

Vulnerability Overview Vulnerability Name: Team Master <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE ID: CVE-2026-8870 CVSS Score: 6.4 (Medium) Published Date: May 26, 2026 Last Updated Date: May 27, 2026 Researcher: Muhammad Yutha - DJ Impact Scope Software Type: Plugin Software Name: Team Master – A Modern WordPress Team Showcase Affected Versions: <= 1.1.2 Vulnerability Description: The Team Master plugin, in versions 1.1.2 and earlier, contains a stored cross-site scripting vulnerability. Arbitrary web scripts can be injected via shortcode attributes, which execute when a user accesses the affected page. Remediation Patch Status: No known patch available Recommended Actions: Review the vulnerability details and apply mitigations based on your organization's risk tolerance. It may be necessary to uninstall the affected software and seek an alternative. Additional Information Reference Links: plugins.trac.wordpress.org Sharing Options: Facebook, Twitter, LinkedIn, Email Disclaimer This record contains copyrighted material provided by Defiant Inc. and The MITRE Corporation. Contact Information For errors or to provide additional information, please contact: wfi-support@wordfence.com Business Hours 9am-8pm ET, 6am-5pm PT, 2pm-1am UTC/GMT (excluding weekends and holidays) 24-hour support, available year-round, with a 1-hour response time Other Links Terms of Service Privacy Policy and Collection Notice Do Not Sell or Share My Personal Information Products and Support Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central News and Updates Blog News Vulnerability Advisories About Wordfence Affiliate Program Careers Contact Security CVE Request Form Subscribe for Updates Enter your email address to subscribe to news and updates Copyright Information © 2012-2026 Defiant Inc. All rights reserved. Other Been hacked? Get help Create Account Log In View Pricing Summary The Team Master plugin, in versions 1.1.2 and earlier, contains a stored cross-site scripting vulnerability. Users are advised to review and take appropriate measures promptly.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-8870: Stored XSS in WordPress Team Master Plugin