CVE-2024-2833: Jobs for WordPress <= 2.7.5 - Reflected Cross-Site Scripting via job-search
The Jobs for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘job-search’ parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2833?
CVE-2024-2833 is classified as a high severity vulnerability due to the potential for unauthenticated attackers to execute arbitrary scripts.
How do I fix CVE-2024-2833?
To fix CVE-2024-2833, update the Jobs for WordPress plugin to version 2.7.6 or later to ensure proper input sanitization and output escaping.
Who is affected by CVE-2024-2833?
Any WordPress site using the Jobs for WordPress plugin versions up to and including 2.7.5 is affected by CVE-2024-2833.
What type of attack does CVE-2024-2833 enable?
CVE-2024-2833 enables attackers to perform Reflected Cross-Site Scripting (XSS) attacks through the 'job-search' parameter.
Is authentication required to exploit CVE-2024-2833?
No, authentication is not required to exploit CVE-2024-2833, making it critical for website security.