Addon Jobsearch Chat CVE-2026-25377

Remote unauthenticated attacker can exploit SQL injection in eyecix Addon Jobsearch Chat versions <= 3.0. No authentication, user interaction, or special configuration required. CVSS vector indicates network-accessible vulnerability with low attack complexity.

This vulnerability carries high real-world risk despite the absence of a CVSS score or EPSS metric. SQL injection vulnerabilities are universally considered critical because they typically allow unauthenticated attackers to compromise database confidentiality and integrity. The attack vector is likely network-based (given it is a WordPress plugin accessible via web), the attack complexity appears low (SQL injection is straightforward to exploit), and it likely requires no authentication, making it highly exploitable. The fact that Patchstack has documented it and ENISA has assigned it a tracking ID (EUVD-2026-15695) indicates that the vulnerability has been assessed as legitimate and noteworthy. Without confirmed KEV (Known Exploited Vulnerability) status or public POC, the immediate active exploitation risk is unclear, but the ease of SQL injection exploitation means attackers will likely develop working exploits quickly. Organizations running versions up to 3.0 of this plugin should treat this as a priority remediation item.

An attacker discovers the plugin is active on a WordPress site and identifies an input field (such as a job search parameter or chat message field) that is not properly sanitized. The attacker injects a SQL fragment such as ' OR '1'='1 or a UNION-based payload to extract sensitive data from the WordPress database, potentially harvesting user credentials, private messages, or job listing information. Given the network-accessible nature of WordPress plugins and the typically low attack complexity of SQL injection, an unauthenticated attacker could execute this attack directly via HTTP requests with minimal technical effort.