EUVD-2026-114600
GHSA-7vc8-973p-5r63
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSelf-register Employer account
-
DeliveryInject script via 'degreetitle' parameter
-
ExploitPayload stored unsanitized in database
-
ExecutionVictim loads injected page
-
ImpactArbitrary script executes in victim browser
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account at Subscriber level or above (PR:L); however, the plugin's self-registration flow lets any visitor create a Subscriber-backed Employer account, so on sites with open registration the practical barrier is minimal. The attacker injects via the 'degreetitle' parameter. Execution is not immediate: a second user must subsequently access the page that renders the injected value, so impact depends on another user (often an administrator) viewing the affected page. Exploitation is limited on sites that disable self-registration, where a valid pre-existing account would be needed. The complete fix is updating to version 2.7.1. |
| Impact | This is a moderate-severity stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) rated by vuln.today as 'this_month' priority rather than urgent. The CVSS vector signals network attack vector, low complexity, and only low privileges (PR:L), with a scope change (S:C) reflecting that injected script executes in other users' browser contexts. The practical privilege barrier is lower than PR:L suggests: the description states the plugin's self-registration flow lets any visitor create a Subscriber-backed Employer account, so the authentication prerequisite is effectively trivial on sites with registration enabled. No CISA KEV listing and no EPSS score are provided in the input, and no confirmed working exploit code is referenced - the references are a Wordfence threat-intel entry and plugin source-code lines, not a weaponized PoC. There is no conflict between signals here: a genuine but not emergency-level issue. The 'this_month' decision label, the absence of KEV, and the low real-world footprint of a niche job-board plugin together place this as a patch-on-normal-cycle item, not a drop-everything priority. Impact is limited to C:L/I:L with no availability impact, consistent with script injection rather than server compromise. |
| Exploit ScenarioDerived | An attacker self-registers an Employer (Subscriber-backed) account on the target site, then submits a malicious script payload through the 'degreetitle' parameter, which is stored without sufficient sanitization. When another user - potentially an administrator reviewing job/degree data - later loads the page rendering that value, the script executes in their browser session. No public working exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 31, 2026
Stored cross-site scripting in the WP Job Portal plugin for WordPress (all versions up to and including 2.7.0) lets authenticated users with Subscriber-level access inject arbitrary web scripts through the 'degreetitle' parameter, which are persisted and later executed in the browser of any user who views the affected page. Because the plugin's self-registration flow lets any visitor create a Subscriber-backed Employer account, sites with open registration are effectively exposed to unauthenticated outsiders, although execution still requires a second user - often an administrator - to access the injected page, and sites that disable self-registration limit exploitation to holders of an existing account. Rated CVSS 6.4 and prioritized by vuln.today as 'this_month' rather than urgent, the flaw is fixed by updating to version 2.7.1; no public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: 2.7.1 - updating the plugin to that release is the only complete fix, since it addresses both the missing input sanitization on save and the missing output escaping on render (download at https://downloads.wordpress.org/plugin/wp-job-portal.2.7.1.zip, advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/45bc4b00-1b5e-4c2e-96c7-77e03b86be5c?source=cve). If the update cannot be applied immediately, the actionable exposure reduction is to disable the plugin's self-registration flow so visitors can no longer mint Subscriber-backed Employer accounts, which removes the trivial path to the required low-privileged account; the trade-off is that legitimate employers can no longer self-onboard and must be created manually, and this does not remove the stored-XSS flaw for users who already hold accounts. On sites that keep registration open, note that a persisted payload executes when another user - potentially an administrator - views the affected page, so restricting which roles can browse user-submitted job and degree data limits the reachable victim set at the cost of workflow access.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79 (improper neutralization of input during web page generation): the plugin saves the 'degreetitle' field without adequate sanitization and renders it without output escaping, so attacker-supplied markup is stored and later emitted unescaped into a page. The cited code references point to the 2.7.0 plugin tree - modules/job/model.php at lines 3728, 3762, 3824 and 1008 (the job/degree data handling path), modules/job/controller.php at line 441, and the main plugin file wp-job-portal.php at line 1786 - which are the locations where the value is processed and where the missing escaping manifests. The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C vector describes network reachability, low attack complexity, low privileges required and no interaction by the injecting attacker, with a scope change (S:C) because the injected script runs in the security context of whichever user later loads the affected page rather than in the context of the injecting account. This is a WordPress-plugin-level flaw, so the Web server and PHP stack are not themselves vulnerable; the weakness is entirely inside the plugin's handling of the degree title field. The specific page template that renders the stored value is not further described in the available sources beyond the cited model and controller code.
Know when Wp Job Portal Ai Powered Recruitment System For Company Or Job Board Website gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Authenticated Subscriber injection (PR:L) over the network with low complexity; stored payload executes in other users' browsers, giving a scope change (S:C) with low confidentiality and integrity impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The WP Job Portal - AI-Powered Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'degreetitle' parameter in all versions up to, and including, 2.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The plugin's self-registration flow allows any visitor to create a Subscriber-backed Employer account, meaning this vulnerability is effectively exploitable by any user who can register on the site.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Authenticated attackers with Subscriber-level access can delete arbitrary files on WordPress servers running WP Job Port
The WP Job Portal plugin for WordPress contains an unauthenticated SQL injection vulnerability in the 'radius' parameter
Exploit-DB