What is the CVSS score of CVE-2026-57368?

CVE-2026-57368 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Jobmonster are affected by CVE-2026-57368?

NooTheme Jobmonster WordPress job-board theme (versions ≤4.8.5) contains a reflected cross-site scripting vulnerability enabling remote attackers to execute arbitrary JavaScript in users' browsers…

How to fix or mitigate CVE-2026-57368?

Within 24 hours: inventory all WordPress instances running NooTheme Jobmonster 4.8.5 or earlier and immediately deactivate the theme in production or restrict access to job-board pages via firewall/reverse-proxy rules. Within 7 days: deploy Web Application Firewall rules blocking reflected XSS payloads, enforce Content Security Policy headers on affected WordPress installations, and enable WordPress security audit logging to detect exploitation attempts. Within 30 days: execute migration to an alternative actively-maintained job-board solution or await vendor patch release (monitor NooTheme security advisories weekly), ensuring data migration without service interruption.

Jobmonster CVE-2026-57368

EUVD-2026-43450 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

XSS Jobmonster WordPress Wordpress Theme

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:09 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Reflected XSS.This issue affects Jobmonster: from n/a through <= 4.8.5.

AnalysisAI

Reflected cross-site scripting in the NooTheme Jobmonster WordPress job-board theme (versions up to and including 4.8.5) lets remote attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Because the flaw carries a scope change (S:C), successful exploitation can affect resources beyond the vulnerable component, such as the authenticated WordPress session of an administrator who is lured into clicking. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.