Easy Jobs Ai Powered Job Listing Job Board Career Page Recruitment Hiring Solution
Monthly
Authenticated stored cross-site scripting in the easy.jobs WordPress plugin (all versions up to and including 2.8.2) lets an attacker with contributor-level access or above inject arbitrary script into the 'icon' attribute of the easyjobs/job-list Gutenberg block, with the payload executing for every visitor who renders the affected page. Sites that restrict content-authoring roles to trusted staff are substantially less exposed, since the attacker must already hold a contributor+ account or be able to register one; sites not using the job-list block are unaffected in practice. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Authenticated stored cross-site scripting in the easy.jobs WordPress plugin (all versions up to and including 2.8.2) lets an attacker with contributor-level access or above inject arbitrary script into the 'icon' attribute of the easyjobs/job-list Gutenberg block, with the payload executing for every visitor who renders the affected page. Sites that restrict content-authoring roles to trusted staff are substantially less exposed, since the attacker must already hold a contributor+ account or be able to register one; sites not using the job-list block are unaffected in practice. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).