What is the CVSS score of CVE-2026-42685?

CVE-2026-42685 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of WP Job Portal are affected by CVE-2026-42685?

The WP Job Portal WordPress plugin (versions through 2.5.1) contains a reflected cross-site scripting vulnerability that enables attackers to inject malicious JavaScript code executed in user…

How to fix or mitigate CVE-2026-42685?

Within 24 hours: Audit all WordPress instances for WP Job Portal plugin v2.5.1 or earlier; disable the plugin if operationally feasible; identify all administrator and editor accounts at risk. Within 7 days: Deploy Web Application Firewall (WAF) rules targeting XSS payload patterns; implement Content Security Policy (CSP) headers on all WordPress sites; enable WordPress security monitoring through Wordfence or equivalent solution. Within 30 days: Establish ongoing vendor advisory monitoring for WP Job Portal security releases; evaluate migration to patched versions or alternative job portal solutions when available; conduct security awareness training for WordPress administrators on social engineering and malicious link threats.

WP Job Portal CVE-2026-42685

EUVD-2026-33910 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-02 Patchstack

GHSA-w29x-75gh-2g79

XSS Wp Job Portal

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 11:50 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad WP Job Portal allows Reflected XSS.

This issue affects WP Job Portal: from n/a through 2.5.1.

AnalysisAI

Reflected cross-site scripting in the WP Job Portal WordPress plugin (versions up to and including 2.5.1) allows remote attackers to inject arbitrary JavaScript that executes in a victim's browser after they click a crafted link. The flaw has CVSS 7.1 elevated by scope change (S:C), meaning script execution can impact resources beyond the vulnerable component, such as the WordPress admin session. No public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

WP Job Portal is a WordPress plugin (CPE cpe:2.3:a:ahmad:wp_job_portal) by author Ahmad that provides job board and recruitment functionality for WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-controlled input from an HTTP request parameter is reflected back into a generated HTML response without sufficient output encoding or contextual escaping. Because the payload is reflected rather than stored, exploitation requires the attacker to deliver the malicious URL to a victim and have them load it in a browser session against the vulnerable site.

RemediationAI

No vendor-released patched version is independently confirmed in the available data; administrators should consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-job-portal/vulnerability/wordpress-wp-job-portal-plugin-2-5-1-cross-site-scripting-xss-vulnerability for the latest fixed release and upgrade WP Job Portal beyond 2.5.1 once that release is published. In the interim, deactivate the WP Job Portal plugin if the job board feature is non-essential (trade-off: job listings will be unavailable to site visitors), or place a Web Application Firewall rule in front of the site to filter reflected XSS payloads on the plugin's request parameters (trade-off: WAF signature gaps may still permit obfuscated payloads). Additionally, restrict administrator browsing habits by enforcing a Content Security Policy that disallows inline scripts on the WordPress site to reduce the impact of any successful reflection (trade-off: may break legitimate plugins or themes that rely on inline JavaScript).