JobBoardWP < 1.1.0 – Admin+ Stored Cross-Site Scripting | CVE 2021-39329 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its Job Data, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

Create/edit a job and put the following payload in any of the Job Data (such as Application Contact): "><script>alert(/XSS/)</script>

The XSS will be triggered when viewing/previewing the job

Affects Plugins

Fixed in 1.1.0

References

CVE

URL

https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39329

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Thinkland Security Team

Verified

Yes

WPVDB ID

7a7efd78-32ad-4156-84ed-351ccadad8b4

Timeline

Publicly Published

2021-10-15 (about 4 years ago)

Added

2021-10-16 (about 4 years ago)

Last Updated

2022-06-17 (about 3 years ago)

Other

Published

Title

Published

2024-05-24

Title

Similarity <= 3.0 - Stored XSS via CSRF

Published

2025-01-24

Title

Booking Calendar Contact Form < 1.2.56 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2025-01-10

Title

WP MediaTagger <= 4.1.1 - Reflected XSS

Published

2025-02-21

Title

.htaccess Login block <= 0.9a - Reflected Cross-Site Scripting

Published

2025-02-14

Title

Magic the Gathering Card Tooltips < 3.6.0 - Unauthenticated Stored Cross-Site Scripting