Vulnerabilities / Ninja Job Board / WPSEC-2026-2464
Ninja Job Board <= 1.4.0 - Unauthenticated Stored Cross-Site Scripting via Application Field Values
High 7.2
CWE-79Fixed in 2.0.0
- ID
- WPSEC-2026-2464
- Plugin
- Ninja Job Board – Ultimate WordPress Job Board Plugin (ninja-job-board)
- Affected
- all versions before 2.0.0
- Remediation
- Update to 2.0.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-04
- Attack surface
- Ninja Job Board on WPSec AttackSurface
- Fix released
- Published
Description
The ninja-job-board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via job application form field values, including file upload field values, in all versions up to, and including, 1.4.0. This is due to the plugin storing submitted field values without sanitization, trusting the client-supplied list of uploaded file names, and outputting the values without escaping in the application view. This makes it possible for unauthenticated attackers submitting a job application to inject arbitrary web scripts that execute whenever an administrator views the application.
References
- https://wpsec.com/vuln/WPSEC-2026-2464/
- https://plugins.svn.wordpress.org/ninja-job-board/tags/2.0.0/
- https://wordpress.org/plugins/ninja-job-board/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS