The Team WordPress plugin before 4.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html…
CVSS 3.1MEDIUM 4.8·Network·High privileges·User interaction·EPSS 0.00326·Published 2025-05-15·Fixed in 4.4.2CWE-79
The Team WordPress plugin before 4.1.2 contains a file which could allow any authenticated users to download arbitrary files from the server via a path traversal vector.
CVSS 3.1HIGH 8.8·Network·Low privileges·No interaction·EPSS 0.01627·Published 2022-08-22·Fixed in 4.1.2CWE-22