EUVD-2026-40107
GHSA-m2vm-g496-48qp
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated, low-complexity, network-delivered XSS needing victim interaction (UI:R) with cross-context execution (S:C) yielding limited confidentiality/integrity impact; availability impact does not realistically apply (A:N).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Jobify <= 4.3.2 versions.
AnalysisAI
Cross-site scripting in the Jobify WordPress job-board theme (Astoundify) through version 4.3.2 lets unauthenticated remote attackers inject script that executes in a victim's browser when the victim is lured into triggering a crafted request or link. The scope-changed CVSS 3.1 score of 7.1 reflects that injected script runs outside the vulnerable component's own boundary, enabling session theft or actions in the WordPress context. No public exploit identified at time of analysis, and the flaw is not in CISA KEV.
Technical ContextAI
Jobify is a commercial WordPress theme by Astoundify (CPE cpe:2.3:a:astoundify:jobify) used to build job-board and listing sites on top of WordPress. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied data is rendered into HTML output without adequate output encoding or input sanitization. Because the theme handles front-end, often publicly reachable forms and listing displays, attacker-controlled input can reach a page context where the browser interprets it as executable script rather than inert text.
RemediationAI
Update the Jobify theme to a release later than 4.3.2 once the vendor (Astoundify) publishes a fixed version; the input does not include an exact patched version number, so confirm the fixed release via the Patchstack advisory at https://patchstack.com/database/wordpress/theme/jobify/vulnerability/wordpress-jobify-theme-4-3-2-cross-site-scripting-xss-vulnerability and the Astoundify changelog before relying on it. As compensating controls until patched, deploy a WordPress-aware WAF or Patchstack's virtual patching to filter XSS payloads (trade-off: rule gaps may still allow novel encodings), add a strict Content-Security-Policy that disallows inline script to blunt injected payload execution (trade-off: may break legitimate inline theme/plugin scripts and require tuning), and restrict or sanitize the affected front-end input fields and listing-submission endpoints (trade-off: could limit legitimate user-generated content). Avoid sending administrators crafted links and audit for unexpected script in stored listings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Astoundify Jobify jobify
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify Jobify
Missing Authorization vulnerability in Astoundify Jobify jobify.3.0. Rated medium severity (CVSS 5.3), this vulnerabilit
Cross-Site Request Forgery (CSRF) vulnerability in Astoundify Jobify jobify allows Cross Site Request Forgery.3.0. Rated
The Jobify - Job Board WordPress Theme for WordPress is vulnerable to unauthorized access and modification of data due t
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today