What is the CVSS score of CVE-2026-22339?

CVE-2026-22339 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of WPJobster are affected by CVE-2026-22339?

WPJobster WordPress theme (through v6.3.5) contains a reflected XSS vulnerability allowing unauthenticated attackers to inject malicious JavaScript into visitor browsers via crafted URLs.

How to fix or mitigate CVE-2026-22339?

24 hours: Audit all WordPress instances for WPJobster theme version 6.3.5 or earlier; document deployment scope. 7 days: Deploy Content Security Policy headers and Web Application Firewall rules to block reflected XSS payloads; alert users against clicking external links to your site; subscribe to vendor security channels. 30 days: If patch remains unavailable, execute theme replacement strategy or conduct comprehensive security review of custom modifications.

WPJobster CVE-2026-22339

EUVD-2026-37659 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-17 Patchstack

WordPress XSS Wpjobster Wordpress Theme

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Reflected XSS reachable over the network without authentication but requiring a victim click; scope changes to the browser with limited C/I/A impact on the session.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:30 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in WPJobster <= 6.3.5 versions.

AnalysisAI

Reflected cross-site scripting in the WPJobster WordPress theme through version 6.3.5 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser when the victim clicks a crafted link. The flaw carries a CVSS 3.1 score of 7.1 with a scope change (S:C), reflecting impact on browser-side resources beyond the vulnerable application. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but Patchstack has catalogued it as a confirmed reflected XSS.

Technical ContextAI

WPJobster is a commercial WordPress theme distributed by Jobster Marketplace that powers freelance/service-marketplace sites, exposing numerous PHP endpoints that render user-controlled GET/POST parameters back into HTML pages. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning at least one parameter is echoed into the response without contextual output encoding or sanitization. Because the payload is reflected rather than stored, the malicious markup is injected only when a victim follows an attacker-supplied URL, executing in the origin of the WordPress site as identified by the CPE cpe:2.3:a:jobster_marketplace:wpjobster.

RemediationAI

No vendor-released patch identified at time of analysis in the supplied data - administrators should monitor the Patchstack advisory (https://patchstack.com/database/wordpress/theme/wpjobster/vulnerability/wordpress-wpjobster-theme-6-3-5-reflected-cross-site-scripting-xss-vulnerability) and the Jobster Marketplace ThemeForest page for an update beyond 6.3.5 and upgrade as soon as one is published. In the interim, place the site behind a WAF such as Patchstack, Wordfence, or Cloudflare with reflected-XSS rules enabled (trade-off: false positives on legitimate search/filter strings), enforce a strict Content-Security-Policy that disallows inline scripts and restricts script-src to trusted origins (trade-off: may break theme widgets that rely on inline JS), require administrators to log out before clicking external links and avoid managing the site from browsers used for general browsing, and consider temporarily restricting /wp-admin to a small allow-list of source IPs to reduce the impact of session hijack.