Input validation vulnerability in Team Showcase 2.1

The Team Showcase plugin for WordPress is vulnerable to a type of attack called Stored Cross-Site Scripting. This attack allows malicious users with contributor-level and higher permissions to inject scripts into pages in WordPress. These scripts will run every time a user visits the page, allowing the malicious user to do things like steal or change information, interfere with the page’s display, and more. The vulnerability exists in all versions of the plugin up to and including version 2.1 because the plugin does not properly check user input or protect the output.