# WP Job Manager <= 2.4.10 - Unauthenticated Stored Cross-Site Scripting via Company Video URL

- **ID:** WPSEC-2026-3131
- **Plugin:** WP Job Manager (`wp-job-manager`), https://wordpress.org/plugins/wp-job-manager/
- **Affected versions:** from 1.22.0 before 2.4.11
- **Fixed in:** 2.4.11 (Update to 2.4.11 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-job-manager
- **Fix released:** 2026-11-13
- **Published:** 2026-11-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3131/

## Description

The WP Job Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the company video URL field in versions 1.22.0 up to, and including, 2.4.10. This is due to insufficient validation of the saved URL before it is used to build the video player. The URL is only cleaned with esc_url, which keeps character references that the browser decodes, and the media player script reads the decoded value back into the page. This makes it possible for unauthenticated attackers, where guest job submission is enabled, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected job listing.

## References

- https://wpsec.com/vuln/WPSEC-2026-3131/
- https://plugins.svn.wordpress.org/wp-job-manager/tags/2.4.11/
- https://wordpress.org/plugins/wp-job-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3131/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.