# WP Job Manager <= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Job Description

- **ID:** WPSEC-2026-1884
- **Plugin:** WP Job Manager (`wp-job-manager`), https://wordpress.org/plugins/wp-job-manager/
- **Affected versions:** all versions before 2.4.9
- **Fixed in:** 2.4.9 (Update to 2.4.9 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin High, affected versions Medium (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-job-manager
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1884/

## Description

The WP Job Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the job listing description in all versions up to, and including, 2.4.8. Descriptions submitted from the front-end job submission form were only filtered with wp_kses_post, so shortcodes, dynamic block markup and media elements (video, audio, source, track) were kept and later expanded or rendered by media players when the listing was displayed. This makes it possible for unauthenticated attackers, where guest job submissions or account creation during submission are allowed, to inject arbitrary web scripts and run arbitrary shortcodes in pages that execute whenever a user views the listing.

## References

- https://wpsec.com/vuln/WPSEC-2026-1884/
- https://plugins.svn.wordpress.org/wp-job-manager/tags/2.4.9/
- https://wordpress.org/plugins/wp-job-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1884/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.