Is CVE-2026-48880 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48880 being exploited in the wild.

How severe is CVE-2026-48880?

Medium severity, with a CVSS score of 6.5, published 15 June 2026.

Which products and versions are affected?

WP Job Portal WP Job Portal <= 2.5.2.

Is there a fix for CVE-2026-48880?

A patch was published on 2026-06-02: Version 2.5.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48880 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-48880?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48880: WP Job Portal Cross-Site Scripting in WordPress plugin

Q: Is there a fix for CVE-2026-48880?

A patch was published on 2026-06-02: Version 2.5.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48880 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-48880?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48880 · Severity: medium · CVSS 6.5 · Published 2026-06-15

WP Job Portal is a WordPress plugin used to create and manage job boards. A security vulnerability allows users with basic 'Subscriber' accounts to inject malicious scripts into the website. If an administrator or another visitor views the affected page, these scripts could lead to unauthorized actions, website defacement, or the theft of sensitive session information.

Quick answers

Is CVE-2026-48880 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48880 being exploited in the wild.
How severe is CVE-2026-48880?: Medium severity, with a CVSS score of 6.5, published 15 June 2026.
Which products and versions are affected?: WP Job Portal WP Job Portal <= 2.5.2.
Is there a fix for CVE-2026-48880?: A patch was published on 2026-06-02: Version 2.5.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48880 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-48880?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The WP Job Portal plugin for WordPress (versions 2.5.2 and earlier) contains a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user-supplied input. An attacker with Subscriber-level privileges can inject malicious HTML or JavaScript payloads that are subsequently executed in the browser of any user who views the compromised content. This is a stored XSS vulnerability that requires a victim (typically an administrator) to interact with the affected page. The issue is resolved in version 2.5.3.

Affected products

WP Job Portal WP Job Portal <= 2.5.2

Timeline

2026-05-07: other: Reported by researcher Baikuya
2026-06-02: patched: Version 2.5.3 released
2026-06-15: disclosed: NVD publication date

References

https://patchstack.com/database/wordpress/plugin/wp-job-portal/vulnerability/wordpress-wp-job-portal-plugin-2-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.