pickplugins team showcase vulnerabilities

Latest pickplugins team showcase CVEs

Newest publication first

1. CVE-2025-62745 WordPress Team Showcase plugin <= 1.22.28 - Cross Site Scripting (XSS) vulnerability

   Published 2026-05-25

   Medium·CVSS 6.5 EPSS 0.17%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Team Showcase allows Stored XSS. This issue affects Team Showcase: from n/a through 1.22.28.

2. CVE-2024-44002 WordPress Team Showcase plugin <= 1.22.25 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2024-09-17

   Medium·CVSS 6.1 EPSS 0.31%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Team Showcase team allows Reflected XSS.This issue affects Team Showcase: from n/a through <= 1.22.25.

3. CVE-2024-43321 WordPress Team Showcase plugin <= 1.22.23 - Cross Site Scripting (XSS) vulnerability

   Published 2024-08-18

   Medium·CVSS 6.5 EPSS 0.26%

   Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PickPlugins Team Showcase allows Stored XSS.This issue affects Team Showcase: from n/a through 1.22.23.

4. CVE-2020-35939 Team Showcase <= 1.22.15 - Object Injection

   Published 2021-01-01

   High·CVSS 8.8 EPSS 2.1%

   PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJA...

5. CVE-2020-35938 Team Showcase <= 1.22.15 - Object Injection

   Published 2021-01-01

   High·CVSS 8.8 EPSS 2.1%

   PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. Th...

6. CVE-2020-35937 Team Showcase <= 1.22.15 - Stored Cross-Site Scripting

   Published 2021-01-01

   High·CVSS 8.0 EPSS 1.7%

   Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must...

7. CVE-2020-35936 Team Showcase <= 1.22.15 - Stored Cross-Site Scripting

   Published 2021-01-01

   High·CVSS 8.0 EPSS 1.7%

   Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be se...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.