Job Manager <= 0.7.22 – Unauthenticated Stored Cross-Site Scripting (XSS) | CVE 2015-2321 | Plugin Vulnerabilities

Description

The Job Manager WordPress plugin was affected by an Unauthenticated Stored Cross-Site Scripting (XSS) security vulnerability.

Proof of Concept

Go to the job listings page (/index.php/jobs/apply/), then click on "send through your résumé", add the payload ('"><img src=x onerror=prompt(document.cookie);>) to the email field.

The JavaScript will be executed on the admin job manager -> applications -> view details page.

Affects Plugins

Fixed in 0.7.23

References

CVE

Exploitdb

URL

https://packetstormsecurity.com/files/#132931/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

Miscellaneous

Submitter

ethicalhack3r

Submitter twitter

Verified

Yes

WPVDB ID

93c33963-e2ed-403e-9e26-5379cd50d849

Timeline

Publicly Published

2015-08-04 (about 10 years ago)

Added

2015-08-04 (about 10 years ago)

Last Updated

2019-10-22 (about 6 years ago)

Other

Published

Title

Published

2024-11-01

Title

BBP Core – Expand bbPress powered forums with useful features < 1.2.6 - Reflected Cross-Site Scripting via add_query_arg Parameter

Published

2024-04-15

Title

WP TradingView <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-10-31

Title

ML Responsive Audio player with playlist Shortcode <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-04-16

Title

EasyEvent <= 1.0.0 - Admin+ Stored XSS

Published

2026-04-07

Title

TableOn – WordPress Posts Table Filterable < 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute