WP Job Manager <= 2.4.10 - Unauthenticated Stored Cross-Site Scripting via Company Video URL
- ID
- WPSEC-2026-3131
- Plugin
- WP Job Manager (wp-job-manager)
- Affected
- from 1.22.0 before 2.4.11
- Remediation
- Update to 2.4.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-14
- Attack surface
- WP Job Manager on WPSec AttackSurface
- Fix released
- Published
Description
The WP Job Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the company video URL field in versions 1.22.0 up to, and including, 2.4.10. This is due to insufficient validation of the saved URL before it is used to build the video player. The URL is only cleaned with esc_url, which keeps character references that the browser decodes, and the media player script reads the decoded value back into the page. This makes it possible for unauthenticated attackers, where guest job submission is enabled, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected job listing.
References
- https://wpsec.com/vuln/WPSEC-2026-3131/
- https://plugins.svn.wordpress.org/wp-job-manager/tags/2.4.11/
- https://wordpress.org/plugins/wp-job-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS