easy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via Candidate-Supplied URLs
- ID
- WPSEC-2026-1827
- Plugin
- easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution (easyjobs)
- Affected
- all versions before 2.8.5
- Remediation
- Update to 2.8.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-28
- Attack surface
- easy.jobs on WPSec AttackSurface
- Fix released
- Published
Description
The easy.jobs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via candidate-supplied URLs (such as video links, attachments and message links) in all versions up to, and including, 2.8.4. This is due to an insufficient URL scheme check that could be bypassed with control characters (e.g. 'java\nscript:'), and to arbitrary URLs being embedded in iframes or used directly as links in the candidate screens of wp-admin. This makes it possible for unauthenticated attackers who submit a job application to inject scripts that execute in an administrator's browser when they view the candidate and interact with the malicious link or embed.
References
- https://wpsec.com/vuln/WPSEC-2026-1827/
- https://plugins.svn.wordpress.org/easyjobs/tags/2.8.5/
- https://wordpress.org/plugins/easyjobs/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS