CVE-2025-14467: WP Job Portal <= 2.4.4 - Authenticated (Editor+) Stored Cross-Site Scripting via Job Description Field
The WP Job Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.4. This is due to the plugin explicitly whitelisting the <script> tag in its WPJOBPORTALALLOWEDTAGS configuration and using insufficient input sanitization when saving job descriptions. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts into job description fields via the job creation/editing interface. These scripts will execute whenever a user accesses an injected page, enabling session hijacking, credential theft, and other malicious activities.This only impacts multi-site installations, or those with unfilteredhtml disabled.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14467?
CVE-2025-14467 is rated as a high severity vulnerability due to its potential for Stored Cross-Site Scripting.
How do I fix CVE-2025-14467?
To fix CVE-2025-14467, update the WP Job Portal plugin to a version later than 2.3.9 that addresses this vulnerability.
What causes CVE-2025-14467?
CVE-2025-14467 is caused by the WP Job Portal plugin whitelisting the `<script>` tag without proper input sanitization.
Which versions are affected by CVE-2025-14467?
CVE-2025-14467 affects all versions of the WP Job Portal plugin up to and including version 2.3.9.
What type of vulnerability is CVE-2025-14467?
CVE-2025-14467 is a Stored Cross-Site Scripting vulnerability that allows attackers to inject malicious scripts.