CVE-2021-39328: Simple Job Board <= 2.9.4 Authenticated Stored Cross-Site Scripting
The Simple Job Board WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $jobboardprivacypolicylabel variable echo'd out via the ~/admin/settings/class-simple-job-board-settings-privacy.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 2.9.4. This affects multi-site installations where unfilteredhtml is disabled for administrators, and sites where unfilteredhtml is disabled.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2021-39328?
CVE-2021-39328 is a vulnerability in the Simple Job Board WordPress plugin that allows for Stored Cross-Site Scripting.
What is the severity of CVE-2021-39328?
CVE-2021-39328 has a severity rating of medium, with a severity value of 4.8.
What is affected by CVE-2021-39328?
The Simple Job Board WordPress plugin version 2.9.4 is affected by CVE-2021-39328.
How does CVE-2021-39328 work?
CVE-2021-39328 occurs due to insufficient escaping on the $job_board_privacy_policy_label variable, allowing for stored cross-site scripting attacks by attackers with administrative user access.
How can CVE-2021-39328 be fixed?
To fix CVE-2021-39328, update the Simple Job Board WordPress plugin to a version that is not affected by the vulnerability.