{
 "id": "WPSEC-2026-2464",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2464/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2464/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2464/index.md",
 "title": "Ninja Job Board <= 1.4.0 - Unauthenticated Stored Cross-Site Scripting via Application Field Values",
 "description": "The ninja-job-board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via job application form field values, including file upload field values, in all versions up to, and including, 1.4.0. This is due to the plugin storing submitted field values without sanitization, trusting the client-supplied list of uploaded file names, and outputting the values without escaping in the application view. This makes it possible for unauthenticated attackers submitting a job application to inject arbitrary web scripts that execute whenever an administrator views the application.",
 "plugin": {
  "slug": "ninja-job-board",
  "name": "Ninja Job Board",
  "full_name": "Ninja Job Board – Ultimate WordPress Job Board Plugin",
  "wordpress_org": "https://wordpress.org/plugins/ninja-job-board/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ninja-job-board/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ninja-job-board"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.0.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.0.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.0.0",
 "remediation": "Update to 2.0.0 or later.",
 "fix_released": "2026-11-03T10:23:22+00:00",
 "published": "2026-11-04T10:54:55+00:00",
 "updated": "2026-11-03T13:23:23.714015+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2464/",
  "https://plugins.svn.wordpress.org/ninja-job-board/tags/2.0.0/",
  "https://wordpress.org/plugins/ninja-job-board/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ninja-job-board",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-04"
 }
}