CVE-2025-11560

HighCVSS 7.1/10Last modified Oct 19, 2026

Description

The Team Members Showcase WordPress plugin before 3.5.0 does not sanitize and escape a parameter before outputting it back in the page, leading to reflected cross-site scripting, which could be used against high-privilege users such as admins.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Affected software

No affected versions have been published.

Timeline

Published
Nov 12, 2025
Last modified
Oct 19, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-115618.8A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurCVE-2025-115634.6URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into saving the output file outside of the current directory without thCVE-2025-115645.3The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missinCVE-2025-115657.3CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated systemCVE-2025-115666.9CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network toCVE-2025-115677.3CWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target installation folder is nCVE-2025-115684.4A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. An attacker witCVE-2025-11576.3A vulnerability was found in Allims lab.online up to 20250201 and classified as critical. This issue affects some unknown processing of the CVE-2025-115704.6Versions of the package drupal-pattern-lab/unified-twig-extensions from 0.0.0 are vulnerable to Cross-site Scripting (XSS) due to insufficieCVE-2025-115712.1Vulnerable endpoints accept user-controlled input through a URL in JSON format which enables command execution. The commands allowed to execCVE-2025-115737.5An infinite loop issue in Amazon.IonDotnet library versions <v1.3.2 may allow a threat actor to cause a denial of service through a speciallCVE-2025-115757.8Incorrect Default Permissions vulnerability in MongoDB Atlas SQL ODBC driver on Windows allows Privilege Escalation.This issue affects Mongo
CVE-2025-11560: High severity, CVSS 7.1 | Vulnix