CVE-2026-124418: WordPress WP Job Portal plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and user interaction to exploit the vulnerability. It is remotely reachable over the network and has low attack complexity.

Q: What is the impact if exploitation succeeds?

This is a stored XSS issue, so attacker-supplied script can be retained and later executed in another user's browser. The reported impact includes low confidentiality, integrity, and availability effects, with scope changed.

Q: Which installations are affected?

WP Job Portal versions through 2.7.2 are affected. The available data does not identify a fixed version or any configuration prerequisites.

Q: What can be done while a patch is unavailable?

The provided information does not list a vendor workaround. Because exploitation requires low privileges, restrict access to low-privileged plugin roles where feasible and review content submitted through the plugin for suspicious script-bearing input.

Published Nov 13, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad WP Job Portal wp-job-portal allows Stored XSS.This issue affects WP Job Portal: from n/a through 2.7.2.

Affected Software

1 affected component

wordpress/wp-job-portal<=2.7.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wp-job-portal to a version that resolves this vulnerability.
Fixed in 2.8.0

Event History

Nov 13, 2026

CVE Published

via MITRE·03:08 PM

Data Sourced

via MITRE·03:08 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and user interaction to exploit the vulnerability. It is remotely reachable over the network and has low attack complexity.

What is the impact if exploitation succeeds?

This is a stored XSS issue, so attacker-supplied script can be retained and later executed in another user's browser. The reported impact includes low confidentiality, integrity, and availability effects, with scope changed.

Which installations are affected?

WP Job Portal versions through 2.7.2 are affected. The available data does not identify a fixed version or any configuration prerequisites.

What can be done while a patch is unavailable?

The provided information does not list a vendor workaround. Because exploitation requires low privileges, restrict access to low-privileged plugin roles where feasible and review content submitted through the plugin for suspicious script-bearing input.

CVE-2026-124418: WordPress WP Job Portal plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the impact if exploitation succeeds?

Which installations are affected?

What can be done while a patch is unavailable?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact if exploitation succeeds?

Which installations are affected?

What can be done while a patch is unavailable?