Read the docs
TI-2024-07195 Aliases CVE-2024-7761GHSA-7vrj-wjmg-rqm2

Simple Job Board < 2.12.2 - Admin+ Stored XSS

Priority MEDIUM 60CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

In the process of testing the Simple Job Board WordPress plugin before 2.12.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00375 31st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Simple Job Board (Unknown): 2.12.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownSimple Job Boardbefore 2.12.22.12.2Patch availableCNA
  • Simple Job Board VendorUnknown Affected before 2.12.2 Fixed in 2.12.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:presstigers:simple_job_board:*:*:*:*:*:wordpress:*:*before 2.12.2VulnerablePressTigers
  • cpe:2.3:a:presstigers:simple_job_board:*:*:*:*:*:wordpress:*:* Versions before 2.12.2 Vulnerable ·PressTigers

Remediation

  • Fix · CNA Simple Job Board (Unknown) Fixed in 2.12.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-7761
  2. 2026-10-03 Alias added: GHSA-7vrj-wjmg-rqm2

References

Exploit 1

  • TI-2024-07196 Simple Job Board < 2.12.6 - Unauthenticated Resumes Download CVSS 3.1LOW 3.7
  • TI-2024-01689 Simple Job Board <= 2.11.0 - Unauthenticated PHP Object Injection via Job Application Fields CVSS 3.1CRITICAL 9.8
  • TI-2023-25511 WordPress Simple Job Board plugin <= 2.10.5 - Broken Access Control vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-13820 WordPress Simple Job Board Plugin <= 2.10.3 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
  • TI-2023-28561 WordPress Simple Job Board Plugin <= 2.10.6 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
  • TI-2024-06812 Simple Job Board <= 2.12.3 - Authenticated (Editor+) PHP Object Injection CVSS 3.1HIGH 7.2
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences