{
 "id": "WPSEC-2026-1884",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1884/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1884/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1884/index.md",
 "title": "WP Job Manager <= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Job Description",
 "description": "The WP Job Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the job listing description in all versions up to, and including, 2.4.8. Descriptions submitted from the front-end job submission form were only filtered with wp_kses_post, so shortcodes, dynamic block markup and media elements (video, audio, source, track) were kept and later expanded or rendered by media players when the listing was displayed. This makes it possible for unauthenticated attackers, where guest job submissions or account creation during submission are allowed, to inject arbitrary web scripts and run arbitrary shortcodes in pages that execute whenever a user views the listing.",
 "plugin": {
  "slug": "wp-job-manager",
  "name": "WP Job Manager",
  "full_name": "WP Job Manager",
  "wordpress_org": "https://wordpress.org/plugins/wp-job-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-job-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-job-manager"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.4.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.4.9"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.4.9",
 "remediation": "Update to 2.4.9 or later.",
 "fix_released": "2026-10-28T01:16:18+00:00",
 "published": "2026-10-29T01:48:36+00:00",
 "updated": "2026-10-28T09:20:02.461237+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1884/",
  "https://plugins.svn.wordpress.org/wp-job-manager/tags/2.4.9/",
  "https://wordpress.org/plugins/wp-job-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-job-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "Medium",
  "as_of": "2026-10-29"
 }
}