What is the CVSS score of CVE-2026-8882?

CVE-2026-8882 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WP ApplicantStack Jobs Display CVE-2026-8882

EUVD-2026-35311 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 Wordfence

GHSA-73h3-jppf-6m58

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 05:16 vuln.today

CVE Published

Jun 09, 2026 - 03:41 nvd

MEDIUM 6.4

DescriptionCVE.org

The WP ApplicantStack Jobs Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the WP ApplicantStack Jobs Display WordPress plugin (all versions through 1.1.1) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via unsanitized shortcode attributes. Because the CVSS vector reflects Changed Scope (S:C), successful injection impacts the browsers of any user - including administrators - who subsequently load the affected page, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit has been identified at time of analysis, and the vulnerability has not been added to CISA KEV.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the Stored XSS variant, within the plugin's shortcode processing logic. WordPress shortcodes allow contributors to embed dynamic content via bracket-based syntax; the affected plugin fails to sanitize input attributes and escape output when rendering them to HTML at lines 88 and 94 of wp-applicantstack-jobs-display.php (as identified via WordPress Trac references). The CPE string cpe:2.3:a:jdm-labs:wp_applicantstack_jobs_display:*:*:*:*:*:*:*:* confirms jdm-labs as the vendor and the wildcard version field indicates all released versions are affected through 1.1.1. The CVSS Changed Scope component reflects that exploitation in one security context (the WordPress backend) produces impact in a different context (victim user browsers).

RemediationAI

No vendor-released patch has been identified at time of analysis - no fixed version number is present in the available intelligence. Site administrators should monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a66b55e0-1b31-4d5f-bcc1-cfd38b613905 for a patched release. As an immediate compensating control, restrict or remove contributor-level accounts that do not require shortcode capabilities - WordPress site administrators can use role-management plugins to strip shortcode execution rights from contributors, though this may limit legitimate editorial workflows. Alternatively, deactivating or uninstalling the WP ApplicantStack Jobs Display plugin entirely eliminates the attack surface at the cost of losing the jobs display functionality. A Web Application Firewall with a WordPress XSS ruleset (such as the Wordfence plugin's firewall) can provide partial mitigation by blocking known XSS payloads in shortcode parameters, but should not be treated as a substitute for patching.