Executive brief
The Job Postings plugin for WordPress contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious scripts into job postings. When other users view the affected pages, these scripts execute in their browsers, potentially allowing attackers to steal session cookies, perform unauthorized actions, or redirect users to malicious sites.
Technical details
The vulnerability is a stored XSS flaw in the Job Postings plugin caused by insufficient input sanitization and output escaping of the 'position_button' parameter. An authenticated attacker with contributor-level access or higher can inject arbitrary JavaScript code via the position_button field when creating or editing a job posting. The malicious script is stored in the database and executed in the context of any user's browser when they access the injected page, compromising user sessions and site integrity. The vulnerability affects all versions up to and including 2.8.1; patches or updated versions should be applied to remediate the issue.
Affected products
- WordPress.org Job Postings up to and including 2.8.1
Timeline
- 2026-09-15: disclosed