Addon Jobsearch Chat EUVD-2026-15694

Remote attacker crafts a malicious URL containing XSS payload and sends it to victim. Victim must click the link in eyecix Addon Jobsearch Chat version 3.0 or earlier. No authentication required. Victim interaction (clicking link) is mandatory.

While a CVSS vector and score are not provided, the vulnerability is categorized as a Reflected XSS flaw with likely network-based attack vector and low-to-moderate complexity typical of input validation bypasses. The absence of EPSS data and KEV status makes definitive prioritization difficult; however, Reflected XSS vulnerabilities in widely-used WordPress plugins are generally considered high-priority due to ease of exploitation via crafted links and potential for worm-like distribution. The confirmation from Patchstack and inclusion in EUVD suggests this is a legitimate, documented issue rather than theoretical. Real-world risk depends on plugin adoption rates and whether patches have been released; the version cap at 3.0 suggests the advisory may predate or be concurrent with a patch release. Organizations should assess plugin adoption within their WordPress fleet and prioritize patching, particularly if the plugin is actively maintained.

An attacker crafts a malicious URL containing JavaScript payloads in a parameter processed by the Addon Jobsearch Chat plugin (e.g., a search or filter field) and sends it to a WordPress administrator or site user via email or social engineering. When the victim clicks the link, the unescaped input is reflected in the page and executed in their browser, allowing the attacker to steal authentication cookies, inject a backdoor admin account, or redirect the user to a credential harvesting page. The reflected nature of the attack means each victim must click the malicious link; however, the low complexity and lack of user interaction required beyond clicking a link make this easily exploitable at scale.