CVE-2025-14467
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The WP Job Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 2.4.4. The plugin explicitly whitelists the `<script>` tag in its `WPJOBPORTAL_ALLOWED_TAGS` configuration and uses insufficient input sanitization when saving job descriptions. Authenticated attackers with Editor-level access and above can inject arbitrary web scripts into job description fields, which execute when a user accesses the page. This only impacts multi-site installations or those with unfiltered_html disabled.
Risk Assessment
Attackers can execute scripts in users' browsers, potentially leading to session hijacking, credential theft, and other malicious activities.
Recommendation
Update the WP Job Portal plugin to a patched version. Restrict user permissions and enable HTML filtering.
Other vulnerabilities in WP Job Portal
See all- CVE-2026-22386Medium
The WP Job Portal plugin by Ahmad (up to version 2.7.1) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-42684Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ahmad WP Job Portal allows Blind SQL Injection. This issue affects WP Job Portal from n/a through 2.5.1.
- CVE-2026-116546Medium
The WP Job Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'degreetitle' parameter in all versions up to, and including, 2.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CVE-2026-81299Medium
The WP Job Portal plugin in versions 2.5.9 and earlier has an Insecure Direct Object References (IDOR) vulnerability for subscribers. Subscriber-level users can access objects (e.g., data) without authorization.
- CVE-2026-65569High
Subscriber SQL Injection in WP Job Portal versions up to 2.5.6.
- CVE-2026-12395Medium
The WP Job Portal WordPress plugin before version 2.5.5 fails to properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with a subscriber-level (self-registerable) account to perform SQL injection attacks.
- CVE-2026-12397Medium
The WP Job Portal WordPress plugin before version 2.5.5 does not verify ownership when returning an employer's contact email for a given job, allowing authenticated users with a subscriber-level (self-registerable) account to read other employers' private account email addresses by enumerating job identifiers.
- CVE-2026-12396Medium
The WP Job Portal WordPress plugin before version 2.5.5 does not perform capability or ownership checks before allowing job moderation actions, allowing authenticated users with a subscriber-level (self-registerable) account to approve, feature, or reject arbitrary jobs, including those owned by other users.
- CVE-2026-57653High
The WP Job Portal plugin version 2.5.2 and earlier contains a SQL injection vulnerability in the Contributor module. This allows an attacker to manipulate database queries.
- CVE-2026-48880Medium
The WP Job Portal plugin versions up to 2.5.2 contain a Cross Site Scripting (XSS) vulnerability that can be exploited by subscribers.
Original NVD description (English source)
The WP Job Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.4. This is due to the plugin explicitly whitelisting the `<script>` tag in its `WPJOBPORTAL_ALLOWED_TAGS` configuration and using insufficient input sanitization when saving job descriptions. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts into job description fields via the job creation/editing interface. These scripts will execute whenever a user accesses an injected page, enabling session hijacking, credential theft, and other malicious activities.This only impacts multi-site installations, or those with unfiltered_html disabled.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS