EUVD-2026-43458Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-reachable unauthenticated stored XSS needing victim view (UI:R) with browser-scope change (S:C) and low confidentiality/integrity impact; availability realistically N for XSS.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch allows Stored XSS.This issue affects JobSearch: from n/a through <= 3.2.9.
AnalysisAI
Stored cross-site scripting in the eyecix JobSearch (wp-jobsearch) WordPress plugin, versions up to and including 3.2.9, lets attackers inject persistent JavaScript that executes in the browsers of users who later view the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates a network-reachable, low-complexity flaw requiring no attacker authentication but relying on a victim viewing the poisoned content, with a scope change reflecting script execution crossing into the victim's browser context. No public exploit identified at time of analysis, and no EPSS score was supplied in the intelligence set.
Technical ContextAI
The affected component is JobSearch, a commercial WordPress job-board plugin published by eyecix and distributed as wp-jobsearch, identified by CPE cpe:2.3:a:eyecix:jobsearch:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input - typically fields such as job listings, company profiles, resumes, or application data handled by the plugin - is rendered into generated HTML without adequate output encoding or sanitization. Because the payload is stored server-side (Stored XSS) rather than reflected per-request, it persists in the site's data and fires whenever the tainted content is rendered, affecting visitors and, depending on where the content surfaces, authenticated administrators in wp-admin.
RemediationAI
No vendor-released patch version identified at time of analysis - the data confirms only that versions through 3.2.9 are affected without naming a fixed release, so administrators should check the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/wp-jobsearch/vulnerability/wordpress-jobsearch-plugin-3-2-9-cross-site-scripting-xss-vulnerability) and the plugin's vendor/ThemeForest changelog for a version later than 3.2.9 and upgrade as soon as one is published. Until a patched release is applied, compensating controls include deploying a WAF or Patchstack virtual patch to filter XSS payloads on JobSearch endpoints, restricting or moderating unauthenticated submission features such as job applications and company/candidate profile fields (trade-off: manual review overhead and slower onboarding), and enforcing a strict Content-Security-Policy that disallows inline scripts to blunt payload execution (trade-off: may break legitimate inline scripts and require tuning). Review existing stored content for injected markup before it is served to administrators.
PHP Object Injection in the eyecix JobSearch (wp-jobsearch) WordPress plugin allows remote attackers to inject crafted s
Unauthenticated SQL injection in the eyecix JobSearch WordPress plugin (versions 3.2.9 and earlier) allows remote attack
Unauthenticated information disclosure in the eyecix JobSearch (wp-jobsearch) WordPress plugin versions up to and includ
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the eyecix JobSearch WordPress plugin through version 3.2
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today