JobSearch CVE-2026-57383

Exploitation requires the attacker to get a malicious payload stored through a JobSearch input field that the plugin renders back without proper encoding (Stored XSS in wp-jobsearch <= 3.2.9), and - per the CVSS UI:R metric - a victim must subsequently view the page containing that stored payload for the script to fire; there is no automatic or unattended trigger. The PR:N metric implies the payload can be planted without authentication, consistent with public-facing job-board submission forms, but this should be verified against the specific vulnerable field since some JobSearch inputs may require a registered candidate or employer account. Limiting factors: the mandatory victim interaction (viewing the content), the browser-only impact scope, and dependence on the site actually exposing the vulnerable JobSearch feature.

This is a moderate-severity issue (CVSS 7.1) warranting routine rather than emergency prioritization. Supporting real-but-bounded risk: the vector is network-reachable (AV:N), low complexity (AC:L), needs no attacker privileges (PR:N), and carries a scope change (S:C) with low confidentiality, integrity, and availability impact. Tempering the risk: exploitation requires user interaction (UI:R) - a victim must view the malicious content - and impact is confined to the browser session (C:L/I:L/A:L) rather than direct server compromise. No CISA KEV listing, no POC, and no EPSS score were provided, so there is no evidence of active or imminent mass exploitation; this reads as a standard Patchstack-catalogued plugin XSS rather than a headline threat. One caveat to verify: PR:N assumes the payload can be planted without authentication (e.g., via an open application/registration form) - if injection actually requires a logged-in contributor or admin, real-world exploitability is lower than the vector implies.

An attacker submits a job application, company profile, or listing through a JobSearch form, embedding a malicious script in a field the plugin later renders without sanitization. When a site administrator or visitor opens the page displaying that content, the script executes in their browser, potentially stealing session cookies, acting as the victim, or redirecting them. No public exploit is currently identified, though the low attack complexity means a working payload would be straightforward to craft.