WordPress Plugin Vulnerabilities

WP Job Openings < 4.1.1 - Author+ Stored XSS via Job Title

Description

The plugin does not sanitise and escape some of its stored data before outputting it in the admin dashboard, and additionally reverses the HTML-entity encoding that would otherwise neutralise it, allowing users with the Author role to perform Stored Cross-Site Scripting attacks that execute in the context of a logged-in administrator.

Proof of Concept

Affects Plugins

Plugin icon
wp-job-openings
Fixed in 4.1.1

References

CVE
CVE-2026-107790

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Md Mehedi Hasan
Submitter
Md Mehedi Hasan
Submitter website
https://mdhasan.me
Verified
Yes
WPVDB ID
4bec1d97-9ab1-4ce7-b108-dcc2a0d9a934

Timeline

Publicly Published
2026-10-19 (about 2 days ago)
Added
2026-10-19 (about 1 day ago)
Last Updated
2026-10-19 (about 1 day ago)

Other

Published
Title
Published
2023-03-28
Title
Custom Post Type and Taxonomy GUI Manager <= 1.1 - Stored XSS via CSRF
Published
2015-04-16
Title
Content Slide <= 1.4.2 - CSRF & Stored XSS
Published
2025-04-07
Title
AAWEP Obfuscator <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting
Published
2026-03-27
Title
Quads Ads Manager for Google AdSense < 2.0.99 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Ad Metadata Parameters
Published
2023-02-13
Title
Product GTIN (EAN, UPC, ISBN) for WooCommerce <= 1.1.1 - Contributor+ Stored XSS