easy.jobs CVE-2026-108366

Exploitation requires (1) the easy.jobs plugin version ≤ 2.8.2 installed and active, and (2) an authenticated account with contributor-level privileges or above on the target WordPress site (PR:L). The specific trigger is injecting a script payload into the 'icon' attribute of the easyjobs/job-list Gutenberg block; the stored payload then fires whenever any user renders the affected page (UI:N for the attacker, but execution depends on a victim viewing the page). Limiting factors that reduce real-world risk: the attacker must already possess (or be able to register) a contributor+ account, so sites that restrict content-authoring roles to trusted staff are substantially less exposed than sites with open or self-service contributor registration; sites not using the easyjobs/job-list block are unaffected in practice.

This is a moderate-severity, authenticated stored XSS (CVSS 6.4). The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N shows network reach and low attack complexity, but the decisive limiter is PR:L - the attacker needs a contributor-level (or higher) account before they can plant the payload, so this is not a mass-exploitable unauthenticated flaw. The scope change (S:C) and UI:N reflect that the injected script executes in the browser of any user who later views the page (e.g. an administrator), which is what gives the issue its real teeth: a low-privileged contributor can potentially escalate by stealing a higher-privileged session. Exploitation status: no public exploit identified at time of analysis - there is no CISA KEV listing and no PoC reference in the supplied data (the only links are the Wordfence advisory, source-code trac lines, and the patch changeset). EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be stated; its absence is a data gap, not evidence of low risk. The vuln.today priority is 'this_month', consistent with a real-but-not-emergency issue: patch on a normal cycle, but note that sites allowing untrusted or self-registered contributor accounts face meaningfully higher risk than sites where all authors are trusted staff.

An attacker holding a contributor-level account on a WordPress site running easy.jobs ≤ 2.8.2 adds or edits a page containing the easyjobs/job-list Gutenberg block and injects a malicious script into the block's 'icon' attribute, which is stored without sufficient sanitization or output escaping. When an administrator or site visitor later loads that page the script executes in their browser, enabling session/cookie theft or actions performed as the victim. No public exploit identified at time of analysis; the attack requires low complexity (AC:L) but a pre-existing authenticated account (PR:L).