CVE-2021-39336: Job Manager <= 0.7.25 Authenticated Stored Cross-Site Scripting
First published: Fri Oct 15 2021(Updated: )
The Job Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/admin-jobs.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 0.7.25. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WP Job Manager | <=0.7.25 |
Remedy
Uninstall plugin from WordPress site.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-39336?
CVE-2021-39336 refers to a vulnerability in the Job Manager WordPress plugin that allows authenticated attackers to inject arbitrary web scripts due to insufficient input validation and sanitization.
What is the severity of CVE-2021-39336?
The severity of CVE-2021-39336 is medium with a CVSS score of 4.8.
How can I fix CVE-2021-39336?
To fix CVE-2021-39336, update to version 0.7.26 or later of the Job Manager WordPress plugin.
What is the affected version of the Job Manager WordPress plugin?
The Job Manager WordPress plugin versions up to and including 0.7.25 are affected by CVE-2021-39336.
What are the references for CVE-2021-39336?
The references for CVE-2021-39336 are: [GitHub](https://github.com/BigTiger2020/word-press/blob/main/Job%20Manager.md), [WordPress Plugin Directory](https://plugins.trac.wordpress.org/browser/job-manager/trunk/admin-jobs.php#L244), [Wordfence Vulnerability Advisories](https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39336).
- agent/weakness
- agent/type
- agent/softwarecombine
- agent/author
- agent/remedy
- agent/title
- agent/description
- agent/severity
- agent/references
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/wp-jobmanager
- canonical/wp job manager
- version/wp job manager/0.7.25