CVE-2024-10105: Jobs for WordPress < 2.7.11 - Contributor+ Stored XSS
The Job Postings WordPress plugin before 2.7.11 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10105?
CVE-2024-10105 is considered a high severity vulnerability as it allows high privilege users to perform Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-10105?
To fix CVE-2024-10105, update the Job Postings plugin to version 2.7.11 or later.
Which versions of the Job Postings plugin are affected by CVE-2024-10105?
CVE-2024-10105 affects versions of the Job Postings plugin prior to 2.7.11.
What type of vulnerability is CVE-2024-10105?
CVE-2024-10105 is a Stored Cross-Site Scripting vulnerability due to inadequate sanitization and escaping of settings.
Who is at risk for CVE-2024-10105?
High privilege users, such as contributors, are at risk for CVE-2024-10105 even when the unfiltered_html capability is restricted.