CVE-2024-2833: XSS
First published: Thu Apr 18 2024(Updated: )
The Jobs for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘job-search’ parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WordPress Jobs | <=2.7.5 | |
| BlueGlass Jobs for WordPress | <2.7.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-2833?
CVE-2024-2833 is classified as a high severity vulnerability due to the potential for unauthenticated attackers to execute arbitrary scripts.
How do I fix CVE-2024-2833?
To fix CVE-2024-2833, update the Jobs for WordPress plugin to version 2.7.6 or later to ensure proper input sanitization and output escaping.
Who is affected by CVE-2024-2833?
Any WordPress site using the Jobs for WordPress plugin versions up to and including 2.7.5 is affected by CVE-2024-2833.
What type of attack does CVE-2024-2833 enable?
CVE-2024-2833 enables attackers to perform Reflected Cross-Site Scripting (XSS) attacks through the 'job-search' parameter.
Is authentication required to exploit CVE-2024-2833?
No, authentication is not required to exploit CVE-2024-2833, making it critical for website security.
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/severity
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/weakness
- agent/remedy
- agent/last-modified-date
- agent/tags
- agent/softwarecombine
- agent/event
- collector/nvd-api
- source/NVD
- vendor/wordpress
- canonical/wordpress jobs
- vendor/blueglass
- canonical/blueglass jobs for wordpress