{
 "id": "WPSEC-2026-1827",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1827/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1827/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1827/index.md",
 "title": "easy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via Candidate-Supplied URLs",
 "description": "The easy.jobs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via candidate-supplied URLs (such as video links, attachments and message links) in all versions up to, and including, 2.8.4. This is due to an insufficient URL scheme check that could be bypassed with control characters (e.g. 'java\\nscript:'), and to arbitrary URLs being embedded in iframes or used directly as links in the candidate screens of wp-admin. This makes it possible for unauthenticated attackers who submit a job application to inject scripts that execute in an administrator's browser when they view the candidate and interact with the malicious link or embed.",
 "plugin": {
  "slug": "easyjobs",
  "name": "easy.jobs",
  "full_name": "easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution",
  "wordpress_org": "https://wordpress.org/plugins/easyjobs/",
  "advisories_url": "https://wpsec.com/vuln/plugin/easyjobs/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/easyjobs"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.8.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.8.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.8.5",
 "remediation": "Update to 2.8.5 or later.",
 "fix_released": "2026-10-27T10:09:12+00:00",
 "published": "2026-10-28T10:46:01+00:00",
 "updated": "2026-10-28T09:33:56.562985+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1827/",
  "https://plugins.svn.wordpress.org/easyjobs/tags/2.8.5/",
  "https://wordpress.org/plugins/easyjobs/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/easyjobs",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-28"
 }
}