# Ninja Job Board <= 1.4.0 - Unauthenticated Stored Cross-Site Scripting via Application Field Values

- **ID:** WPSEC-2026-2464
- **Plugin:** Ninja Job Board – Ultimate WordPress Job Board Plugin (`ninja-job-board`), https://wordpress.org/plugins/ninja-job-board/
- **Affected versions:** all versions before 2.0.0
- **Fixed in:** 2.0.0 (Update to 2.0.0 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ninja-job-board
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2464/

## Description

The ninja-job-board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via job application form field values, including file upload field values, in all versions up to, and including, 1.4.0. This is due to the plugin storing submitted field values without sanitization, trusting the client-supplied list of uploaded file names, and outputting the values without escaping in the application view. This makes it possible for unauthenticated attackers submitting a job application to inject arbitrary web scripts that execute whenever an administrator views the application.

## References

- https://wpsec.com/vuln/WPSEC-2026-2464/
- https://plugins.svn.wordpress.org/ninja-job-board/tags/2.0.0/
- https://wordpress.org/plugins/ninja-job-board/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2464/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.