Security Alert Summary
The WP Job Portal – AI-Powered Recruitment System for Company or Job Board website plugin contains a stored cross-site scripting (XSS) vulnerability in the degreetitle parameter in all versions up to and including 2.7.0. Insufficient input sanitization and output escaping allow authenticated users (subscriber-level and above) or any visitor who can self-register an Employer account to inject scripts that execute when an injected page is viewed.
CVE Details
- CVE ID: CVE-2026-116546
- Affected component: WP Job Portal – AI-Powered Recruitment System for Company or Job Board website plugin for WordPress
- Affected versions: All versions up to and including 2.7.0
- Published: October 31, 2026, 07:16:35 AM
- Last modified: October 31, 2026, 07:16:35 AM
- CVSS v3.1 base score: 6.4
- CVSS v3.1 severity: MEDIUM
- CVSS vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges required / user interaction: Privileges Required: LOW (authenticated, subscriber-level and above); User Interaction: NONE
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Weakness (CWE): CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The vulnerability is a stored cross-site scripting (XSS) issue arising from insufficient input sanitization and output escaping for the degreetitle parameter. When crafted input containing script code is stored by the plugin and later rendered in a page without proper escaping, that script runs in the browser of any user who views the page.
The plugin’s self-registration flow allows a visitor to create a Subscriber-backed Employer account, which means an attacker can register and submit malicious content via the vulnerable parameter. The CVE references plugin files under the job module and the main plugin file (controller and model locations are listed in the references), indicating the vulnerable handling occurs in the job-related request or display logic.
Exploit impact is limited to what injected scripts can accomplish in the context of a victim’s browser and the site origin. Typical impacts include actions that affect the browsing session (for example, reading or interacting with content on pages the script can access) rather than direct server-side takeover indicated by the CVSS scope and impact ratings.
How This Could Impact Your Website
Consider a site with a site owner, internal staff (editors or HR users), and external contributors or contractors who may register to submit job listings. An attacker who registers as an Employer can submit a job entry with a malicious degreetitle value. When internal staff or other users view the job listing, the injected script executes in their browsers.
- Internal staff or contractors who view affected pages could have session data or page-level information exposed to the injected script, increasing the risk of targeted phishing or social engineering against those users.
- Information such as visible user names or email addresses displayed on pages might be harvested by client-side scripts, enabling more convincing spear-phishing campaigns aimed at staff, contractors, or suppliers.
- While this vulnerability does not indicate direct server compromise, it raises the likelihood of successful social-engineering attacks that could lead to credential theft or additional follow-on attacks.
“If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.”
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level and subscriber accounts with submission capabilities.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior related to content submission or unexpected script content on pages.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://downloads.wordpress.org/plugin/wp-job-portal.2.7.1.zip
- https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.7.0/modules/job/controller.php#L441
- https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.7.0/modules/job/model.php#L1008
- https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.7.0/modules/job/model.php#L3728
- https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.7.0/modules/job/model.php#L3762
- https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.7.0/modules/job/model.php#L3824
- https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.7.0/wp-job-portal.php#L1786
- https://www.wordfence.com/threat-intel/vulnerabilities/id/45bc4b00-1b5e-4c2e-96c7-77e03b86be5c?source=cve
