EUVD-2026-43458Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-reachable unauthenticated stored XSS needing victim view (UI:R) with browser-scope change (S:C) and low confidentiality/integrity impact; availability realistically N for XSS.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch allows Stored XSS.This issue affects JobSearch: from n/a through <= 3.2.9.
AnalysisAI
Stored cross-site scripting in the eyecix JobSearch (wp-jobsearch) WordPress plugin, versions up to and including 3.2.9, lets attackers inject persistent JavaScript that executes in the browsers of users who later view the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates a network-reachable, low-complexity flaw requiring no attacker authentication but relying on a victim viewing the poisoned content, with a scope change reflecting script execution crossing into the victim's browser context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to get a malicious payload stored through a JobSearch input field that the plugin renders back without proper encoding (Stored XSS in wp-jobsearch <= 3.2.9), and - per the CVSS UI:R metric - a victim must subsequently view the page containing that stored payload for the script to fire; there is no automatic or unattended trigger. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-severity issue (CVSS 7.1) warranting routine rather than emergency prioritization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a job application, company profile, or listing through a JobSearch form, embedding a malicious script in a field the plugin later renders without sanitization. When a site administrator or visitor opens the page displaying that content, the script executes in their browser, potentially stealing session cookies, acting as the victim, or redirecting them. … |
| Remediation | No vendor-released patch version identified at time of analysis - the data confirms only that versions through 3.2.9 are affected without naming a fixed release, so administrators should check the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/wp-jobsearch/vulnerability/wordpress-jobsearch-plugin-3-2-9-cross-site-scripting-xss-vulnerability) and the plugin's vendor/ThemeForest changelog for a version later than 3.2.9 and upgrade as soon as one is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations running eyecix JobSearch plugin version 3.2.9 or earlier and assess business-criticality of job search functionality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated SQL injection in the eyecix JobSearch WordPress plugin (versions 3.2.9 and earlier) allows remote attack
Unauthenticated information disclosure in the eyecix JobSearch (wp-jobsearch) WordPress plugin versions up to and includ
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the eyecix JobSearch WordPress plugin through version 3.2
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today