CVE-2026-12114

Name of the Vulnerable Software and Affected Versions Team Members – Multi Language Supported Team Plugin versions prior to 8.8

Description Insufficient input sanitization and output escaping in the admin settings allow authenticated attackers with administrator-level permissions and above to perform Stored Cross-Site Scripting (XSS). This occurs via the custom css parameter, enabling the injection of arbitrary web scripts into pages that execute when accessed by a user. This issue specifically affects multi-site installations and environments where unfiltered html has been disabled.

Recommendations Update Team Members – Multi Language Supported Team Plugin to version 8.8 or later. As a temporary mitigation, restrict access to the custom css parameter in the admin settings.