# Ninja Job Board <= 1.4.0 - Unauthenticated CSV Injection via Application Field Values

- **ID:** WPSEC-2026-2465
- **Plugin:** Ninja Job Board – Ultimate WordPress Job Board Plugin (`ninja-job-board`), https://wordpress.org/plugins/ninja-job-board/
- **Affected versions:** all versions before 2.0.0
- **Fixed in:** 2.0.0 (Update to 2.0.0 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-1236
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ninja-job-board
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2465/

## Description

The ninja-job-board plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.4.0. This is due to submitted application field values being written to the CSV export without neutralizing leading formula characters such as =, +, - and @. This makes it possible for unauthenticated attackers to embed malicious formulas in an application that execute when an administrator exports the applications and opens the file in a spreadsheet program.

## References

- https://wpsec.com/vuln/WPSEC-2026-2465/
- https://plugins.svn.wordpress.org/ninja-job-board/tags/2.0.0/
- https://wordpress.org/plugins/ninja-job-board/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2465/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.