Vulnerabilities / JS Job Manager / WPSEC-2026-0383
JS Job Manager < 2.0.3 - Unauthenticated Stored Cross-Site Scripting via Resume Video Field
High 7.2
CWE-79Fixed in 2.0.3
- ID
- WPSEC-2026-0383
- Plugin
- JS Job Manager (js-jobs)
- Affected
- all versions before 2.0.3
- Remediation
- Update to 2.0.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- JS Job Manager on WPSec AttackSurface
- Fix released
- Published
Description
The JS Job Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the resume video field in all versions up to, but not including, 2.0.3, due to the field's embed markup being stored without sanitization and output without sufficient escaping. Because visitors may submit resumes by default, this makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user, such as an employer or administrator, views the resume.
References
- https://wpsec.com/vuln/WPSEC-2026-0383/
- https://plugins.svn.wordpress.org/js-jobs/tags/2.0.3/
- https://wordpress.org/plugins/js-jobs/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS