WordPress Plugin Vulnerabilities

WP Job Portal < 2.5.5 - Subscriber+ SQL Injection via Applied Resumes 'ta' Parameter

Description

The plugin does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with a subscriber-level (self-registerable) account to perform SQL injection attacks.

Proof of Concept

Affects Plugins

Plugin icon
wp-job-portal
Fixed in 2.5.5

References

CVE
CVE-2026-12395

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
7.7 (high)

Miscellaneous

Original Researcher
Meher Sudhakar Abbireddi
Submitter
Meher Sudhakar Abbireddi
Verified
Yes
WPVDB ID
0183c669-cb09-4d53-852f-a0a877691d1e

Timeline

Publicly Published
2026-06-25 (about 21 days ago)
Added
2026-06-25 (about 20 days ago)
Last Updated
2026-07-10 (about 5 days ago)

Other

Published
Title
Published
2025-04-09
Title
Review Stars Count For WooCommerce <= 2.0 - Authenticated (Subscriber+) SQL Injection
Published
2026-06-08
Title
Advanced 301 and 302 Redirect < 1.7.0 - Unauthenticated SQL Injection
Published
2023-09-04
Title
WP Project Manager < 2.6.1 - Subscriber+ SQLi
Published
2021-02-04
Title
wpDataTables < 3.4.1 - Unauthenticated SQL Injection
Published
2024-02-26
Title
NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor < 2.8.3 - Unauthenticated SQL Injection