Description

The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'position_button' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-15T07:16:26.757Z",
  "pubdate": "2026-09-15T07:16:26.757Z",
  "executiveSummary": "The Job Postings plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability residing within the 'position_button' parameter.\nThis vulnerability allows authenticated attackers, possessing contributor-level privileges or higher, to inject arbitrary malicious JavaScript into the application's database.\nWhen a user or administrator navigates to a page rendered with the compromised data, the malicious script executes within the context of the victim's browser session.\nThe vulnerability stems from inadequate input sanitization and a failure to properly escape output, facilitating unauthorized script execution.\nSuccessful exploitation could lead to session hijacking, unauthorized actions performed on behalf of the victim, or the theft of sensitive session cookies.\nThe vulnerability affects all versions of the Job Postings plugin up to, and including, 2.8.1.\nOrganizations utilizing this plugin are at risk of secondary attacks targeting their administrative user base, necessitating urgent remediation.",
  "technicalDetails": "The vulnerability is classified as Stored Cross-Site Scripting (XSS), stemming from the application's failure to implement robust input validation and context-aware output encoding on the 'position_button' parameter.\nThe vulnerable component processes input provided through this parameter, which is then stored directly within the WordPress database without sufficient sanitization of dangerous HTML tags or JavaScript event handlers.\nThe attack flow begins with an authenticated attacker, holding at least contributor-level privileges, submitting a crafted payload via the 'position_button' input field. Because the application lacks server-side sanitization, the payload is persisted in the database.\nWhen a legitimate user or administrator views a page where this input is rendered, the application reflects the stored, malicious JavaScript back to the browser. The browser interprets the injected script as legitimate code rather than data, executing it within the victim's current security context.\nSince the script executes in the victim's session, the attacker can leverage the victim's current browser cookies and session tokens to perform actions unauthorized by the user.\nThe lack of output escaping ensures that any payload, such as '<script>alert(document.cookie)</script>' or event-based handlers like 'onmouseover', is rendered directly into the HTML Document Object Model (DOM).\nPost-exploitation impact includes, but is not limited to, unauthorized administrative operations, such as creating new user accounts with elevated privileges, altering plugin configurations, or exfiltrating sensitive session data through cross-site request forgery (CSRF) or direct cookie theft.\nThe requirement for authenticated access significantly limits the attack surface; however, the persistent nature of Stored XSS makes this a high-severity concern, as it remains active until the malicious entry is removed from the database or the vulnerable code path is patched."
}