{
 "id": "WPSEC-2026-3131",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3131/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3131/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3131/index.md",
 "title": "WP Job Manager <= 2.4.10 - Unauthenticated Stored Cross-Site Scripting via Company Video URL",
 "description": "The WP Job Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the company video URL field in versions 1.22.0 up to, and including, 2.4.10. This is due to insufficient validation of the saved URL before it is used to build the video player. The URL is only cleaned with esc_url, which keeps character references that the browser decodes, and the media player script reads the decoded value back into the page. This makes it possible for unauthenticated attackers, where guest job submission is enabled, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected job listing.",
 "plugin": {
  "slug": "wp-job-manager",
  "name": "WP Job Manager",
  "full_name": "WP Job Manager",
  "wordpress_org": "https://wordpress.org/plugins/wp-job-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-job-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-job-manager"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.22.0",
    "from_inclusive": true,
    "to": "2.4.11",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.22.0 before 2.4.11"
  ]
 },
 "introduced_in": "1.22.0",
 "fixed_in": "2.4.11",
 "remediation": "Update to 2.4.11 or later.",
 "fix_released": "2026-11-13T09:01:42+00:00",
 "published": "2026-11-14T09:40:51+00:00",
 "updated": "2026-11-13T15:52:52.962847+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3131/",
  "https://plugins.svn.wordpress.org/wp-job-manager/tags/2.4.11/",
  "https://wordpress.org/plugins/wp-job-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-job-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-11-14"
 }
}