CVE-2025-3521: 
WordPress vulnerability analysis and mitigation

The Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder plugin for WordPress is affected by a Stored Cross-Site Scripting vulnerability (CVE-2025-3521) discovered and disclosed on April 30, 2025. The vulnerability affects versions up to and including 3.4.0 of the plugin (NVD CVE, Wiz Report).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue, categorized under CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page). It has received a CVSS v3.1 base score of 6.4 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The issue stems from insufficient input sanitization and output escaping in the Social Link icons functionality (NVD CVE).

The vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These injected scripts will execute whenever a user accesses the affected page, potentially compromising user data and website security (NVD CVE).

Users are advised to update to a version newer than 3.4.0 of the Team Members plugin. The vulnerability has been addressed in subsequent releases with improved input sanitization and output escaping mechanisms (WordPress Plugin).