WP Job Manager <= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Job Description
- ID
- WPSEC-2026-1884
- Plugin
- WP Job Manager (wp-job-manager)
- Affected
- all versions before 2.4.9
- Remediation
- Update to 2.4.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-29
- Attack surface
- WP Job Manager on WPSec AttackSurface
- Fix released
- Published
Description
The WP Job Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the job listing description in all versions up to, and including, 2.4.8. Descriptions submitted from the front-end job submission form were only filtered with wp_kses_post, so shortcodes, dynamic block markup and media elements (video, audio, source, track) were kept and later expanded or rendered by media players when the listing was displayed. This makes it possible for unauthenticated attackers, where guest job submissions or account creation during submission are allowed, to inject arbitrary web scripts and run arbitrary shortcodes in pages that execute whenever a user views the listing.
References
- https://wpsec.com/vuln/WPSEC-2026-1884/
- https://plugins.svn.wordpress.org/wp-job-manager/tags/2.4.9/
- https://wordpress.org/plugins/wp-job-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS