WP Job Portal EUVD-2026-33910

Exploitation requires a victim - ideally an authenticated WordPress user, especially an administrator - to click an attacker-crafted URL that targets a vulnerable parameter in the WP Job Portal plugin (versions through 2.5.1) on a site where the plugin is installed and active. Limiting factors per the CVSS vector: user interaction is mandatory (UI:R), so the attacker must successfully phish or otherwise lure the target; impact is bounded by the privileges of the victim's browser session, meaning maximum damage is realized only when an admin is targeted; and the site must expose the vulnerable plugin endpoint to the attacker-supplied URL.

The CVSS v3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L indicates network-reachable, low-complexity exploitation with no authentication needed, but it does require user interaction (clicking a crafted link). The scope change (S:C) raises the score to 7.1 and reflects that injected script runs in the security context of the WordPress site, potentially affecting an authenticated administrator's session if they are lured. EPSS data was not provided in the input, the vulnerability is not on the CISA KEV list, and no public proof-of-concept was identified at time of analysis - together suggesting this is a meaningful but not high-urgency issue compared to actively exploited admin-takeover bugs in the WordPress ecosystem. The realistic risk skews higher on sites that expose the plugin's affected endpoint publicly and have privileged users who can be socially engineered.

An attacker crafts a URL pointing at a WP Job Portal endpoint on a target WordPress site, embedding a malicious JavaScript payload in a vulnerable parameter, and sends the link to an administrator via phishing email or a forum post. When the administrator clicks the link while logged in, the reflected script executes in their browser under the site's origin and can exfiltrate session cookies, perform actions as the admin via the WordPress REST API, or pivot to plant a persistent backdoor.