Live › vulnerability › CVE-2026-112365
The easy.jobs WordPress job board plugin does not sanitize the cover_letter field, so an unauthenticated visitor can store a script in a job application. When an administrator opens that candidate's Application tab and clicks the attacker's link, the script runs in the admin's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Sites running the easy.jobs plugin at version 2.8.4 or earlier that accept job applications through its cover letter field. The risk lands on administrators and staff who review candidate applications in the WordPress admin. Sites without the plugin, or running a newer version than 2.8.4, are outside the stated range.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| easyjobs | wordpress | <= 2.8.4 | 2.8.5 |
Update easy.jobs to or later (per WPSec; not yet confirmed on the vendor changelog)
2.8.5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cover_letter' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires an administrator to open the affected candidate's Application tab and click the attacker-crafted link, at which point WHATWG URL parsing collapses the encoded scheme back to javascript: and executes the payload.
This page as .md · .json · in your agent: get_signal("CVE-2026-112365")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.