WP Job Portal <= 2.4.4 - Authenticated (Editor+) Stored Cross-Site Scripting via Job Description Field
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The WP Job Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.4. This is due to the plugin explicitly whitelisting the `<script>` tag in its `WPJOBPORTAL_ALLOWED_TAGS` configuration and using insufficient input sanitization when saving job descriptions. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts into job description fields via the job creation/editing interface. These scripts will execute whenever a user accesses an injected page, enabling session hijacking, credential theft, and other malicious activities.This only impacts multi-site installations, or those with unfiltered_html disabled.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| wpjobportal | WP Job Portal – AI-Powered Recruitment System for Company or Job Board website | up to 2.3.9 | — | No fix listed | CNA |
- WP Job Portal – AI-Powered Recruitment System for Company or Job Board website Vendorwpjobportal Affected up to 2.3.9 Fixed in — No fix listed CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wpjobportal:wp_job_portal:*:*:*:*:*:*:*:* | — | — | wpjobportal |
- cpe:2.3:a:wpjobportal:wp_job_portal:*:*:*:*:*:*:*:* Versions — — ·wpjobportal
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-14467
- 2026-10-03 Alias added: GHSA-85vc-jr29-fm6f
References
Other 7
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0c347b9f-d297-4cb5-9c4a-1001d845ed5a?source=cve
- https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.3.9/includes/constants.php#L351
- https://plugins.trac.wordpress.org/browser/wp-job-portal/trunk/includes/constants.php#L351
- https://plugins.trac.wordpress.org/browser/wp-job-portal/trunk/modules/job/model.php#L1278
- https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.3.9/modules/job/model.php#L1278
- https://plugins.trac.wordpress.org/browser/wp-job-portal/trunk/modules/job/tmpl/views/frontend/title.php#L231
- https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.3.9/modules/job/tmpl/views/frontend/title.php#L231
More wpjobportal vulnerabilities
- TI-2023-04143 WP Job Portal < 2.0.6 - Unauthenticated SQLi CVSS 3.1CRITICAL 9.8
- TI-2024-07372 Path traversal in wpjobportal WP Job Portal – AI-Powered Recruitment System for Company… CVSS 3.1CRITICAL 9.8
- TI-2025-30600 WordPress WP Job Portal plugin <= 2.3.2 - SQL Injection Vulnerability CVSS 3.1CRITICAL 9.3
- TI-2025-29935 WordPress WP Job Portal plugin <= 2.3.1 - Local File Inclusion vulnerability CVSS 3.1CRITICAL 9.8
- TI-2022-20161 WordPress WP Job Portal Plugin <= 2.0.1 is vulnerable to Broken Access Control CVSS 3.1CRITICAL 9.8
- TI-2024-10861 WP Job Portal <= 2.2.2 - Missing Authorization to Limited Privilege Escalation CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-14467 · CVE Program
- CVE-2025-14467 · NVD
- FIRST EPSS
- GHSA-85vc-jr29-fm6f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences