Averonsec

**Name of the Vulnerable Software and Affected Versions** Team Members – Multi Language Supported Team Plugin versions prior to 8.8 **Description** Insufficient input sanitization and output escaping in the admin settings allow authenticated attackers with administrator-level permissions and above to perform Stored Cross-Site Scripting (XSS). This occurs via the `custom css` parameter, enabling the injection of arbitrary web scripts into pages that execute when accessed by a user. This issue specifically affects multi-site installations and environments where `unfiltered html` has been disabled. **Recommendations** Update Team Members – Multi Language Supported Team Plugin to version 8.8 or later. As a temporary mitigation, restrict access to the `custom css` parameter in the admin settings.