What is the CVSS score of CVE-2026-24979?

CVE-2026-24979 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Jobica Core are affected by CVE-2026-24979?

CVE-2026-24979 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 7.1.

How to fix or mitigate CVE-2026-24979?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

Jobica Core CVE-2026-24979

EUVD-2026-15598 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-25 Patchstack

GHSA-rjxq-5wqh-3g3r

XSS Jobica Core

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15598

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobica Core jobica-core allows Reflected XSS.This issue affects Jobica Core: from n/a through <= 1.4.1.

AnalysisAI

A Reflected Cross-Site Scripting (XSS) vulnerability exists in NooTheme Jobica Core plugin through version 1.4.1, allowing attackers to inject malicious scripts into web pages viewed by users. This vulnerability affects the WordPress plugin ecosystem and could enable attackers to steal session cookies, redirect users to phishing sites, or perform actions on behalf of authenticated users. No CVSS score or EPSS data is currently available, and the vulnerability has not been formally added to the CISA Known Exploited Vulnerabilities (KEV) catalog, though active exploitation potential exists given the Reflected XSS attack vector's simplicity.

Technical ContextAI

The vulnerability stems from improper input neutralization during web page generation (CWE-79), a classic Reflected XSS flaw where user-supplied input is echoed back to the browser without sanitization or encoding. The affected product is NooTheme Jobica Core (CPE: cpe:2.3:a:nootheme:jobica_core:*:*:*:*:*:*:*:*), a WordPress plugin component. Reflected XSS occurs when an application includes unsanitized query parameters, form data, or HTTP headers directly in HTML output, allowing attackers to craft malicious URLs that execute JavaScript in victims' browsers when clicked. The root cause is the absence of output encoding functions (such as esc_attr(), esc_url(), or htmlspecialchars() in WordPress development) and input validation mechanisms within the Jobica Core plugin's request handling logic.

RemediationAI

Immediately upgrade NooTheme Jobica Core to a patched version above 1.4.1 as soon as a vendor security update is released and verified. Monitor the Patchstack database (https://patchstack.com/database/Wordpress/Plugin/jobica-core) and official NooTheme channels for patch availability. As an interim mitigation, disable the Jobica Core plugin entirely if it is not actively required, or restrict access to the WordPress administration panel and plugin pages using Web Application Firewall (WAF) rules to block suspicious query parameters. Additionally, implement Content Security Policy (CSP) headers on the affected WordPress site to mitigate XSS payload execution, configure security headers (X-XSS-Protection), and conduct input validation audits of any custom code integrating with Jobica Core.