Medium · 6.5 CVE-2025-62745 EUVD-2025-209926GHSA-wq9m-x4hh-h63p

WordPress Team Showcase plugin <= 1.22.28 - Cross Site Scripting (XSS) vulnerability

Published May 25, 2026 · Updated May 26, 2026 · Assigned by Patchstack

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Team Showcase allows Stored XSS.

This issue affects Team Showcase: from n/a through 1.22.28.

Vendor	Product	Affected	Fixed
PickPlugins	Team Showcase	≤ 1.22.28	—