Wp Job Portal Ai Powered Recruitment System For Company Or Job Board Website
Monthly
Authenticated attackers with Subscriber-level access can delete arbitrary files on WordPress servers running WP Job Portal plugin versions up to 2.4.9, enabling remote code execution by removing critical files like wp-config.php. The vulnerability stems from insufficient file path validation in the removeFileCustom function. EPSS exploitation probability is 0.25% (48th percentile), indicating low predicted real-world exploitation likelihood, though the CVSS score of 8.8 reflects high potential impact when successfully exploited. No public exploit identified at time of analysis.
The WP Job Portal plugin for WordPress contains an unauthenticated SQL injection vulnerability in the 'radius' parameter affecting all versions up to and including 2.4.8. Unauthenticated remote attackers can exploit this flaw to extract sensitive information from the database, including user credentials, personal data, and other confidential information stored in WordPress tables. The vulnerability has a CVSS score of 7.5 indicating high severity with no authentication required for exploitation.
Stored cross-site scripting in the WP Job Portal plugin for WordPress (all versions up to and including 2.7.0) lets authenticated users with Subscriber-level access inject arbitrary web scripts through the 'degreetitle' parameter, which are persisted and later executed in the browser of any user who views the affected page. Because the plugin's self-registration flow lets any visitor create a Subscriber-backed Employer account, sites with open registration are effectively exposed to unauthenticated outsiders, although execution still requires a second user - often an administrator - to access the injected page, and sites that disable self-registration limit exploitation to holders of an existing account. Rated CVSS 6.4 and prioritized by vuln.today as 'this_month' rather than urgent, the flaw is fixed by updating to version 2.7.1; no public exploit identified at time of analysis.
Authenticated attackers with Subscriber-level access can delete arbitrary files on WordPress servers running WP Job Portal plugin versions up to 2.4.9, enabling remote code execution by removing critical files like wp-config.php. The vulnerability stems from insufficient file path validation in the removeFileCustom function. EPSS exploitation probability is 0.25% (48th percentile), indicating low predicted real-world exploitation likelihood, though the CVSS score of 8.8 reflects high potential impact when successfully exploited. No public exploit identified at time of analysis.
The WP Job Portal plugin for WordPress contains an unauthenticated SQL injection vulnerability in the 'radius' parameter affecting all versions up to and including 2.4.8. Unauthenticated remote attackers can exploit this flaw to extract sensitive information from the database, including user credentials, personal data, and other confidential information stored in WordPress tables. The vulnerability has a CVSS score of 7.5 indicating high severity with no authentication required for exploitation.
Stored cross-site scripting in the WP Job Portal plugin for WordPress (all versions up to and including 2.7.0) lets authenticated users with Subscriber-level access inject arbitrary web scripts through the 'degreetitle' parameter, which are persisted and later executed in the browser of any user who views the affected page. Because the plugin's self-registration flow lets any visitor create a Subscriber-backed Employer account, sites with open registration are effectively exposed to unauthenticated outsiders, although execution still requires a second user - often an administrator - to access the injected page, and sites that disable self-registration limit exploitation to holders of an existing account. Rated CVSS 6.4 and prioritized by vuln.today as 'this_month' rather than urgent, the flaw is fixed by updating to version 2.7.1; no public exploit identified at time of analysis.