{"id":"CVE-2026-112365","kind":"vulnerability","aliases":["CVE-2026-112365"],"related":[],"title":"easy.jobs WordPress plugin: stored XSS via cover letter field","description":"The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cover_letter' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires an administrator to open the affected candidate's Application tab and click the attacker-crafted link, at which point WHATWG URL parsing collapses the encoded scheme back to javascript: and executes the payload.","summary":"The easy.jobs WordPress job board plugin does not sanitize the cover_letter field, so an unauthenticated visitor can store a script in a job application. When an administrator opens that candidate's Application tab and clicks the attacker's link, the script runs in the admin's browser.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"easyjobs","fixed":["2.8.5"],"affected":"<= 2.8.4","ecosystem":"wordpress"}],"ecosystems":[],"tags":["easy-jobs","package","self-hosted","unauthenticated","wordpress","xss"],"not_affected_if":["newer-version","plugin-not-installed"],"how_to_check":"- WordPress admin > Plugins: find easy.jobs (slug easyjobs); version 2.8.4 or earlier is affected\n- Or read the Version header in wp-content/plugins/easyjobs/easyjobs.php\n- Review stored applications for cover_letter content containing links with odd schemes (e.g. java&#10;script:, encoded javascript:)","fix":"Update easy.jobs to 2.8.5 or later (per WPSec; not yet confirmed on the vendor changelog)","status":"open","published_at":"2026-10-30T18:17:20+00:00","first_seen_at":"2026-10-30T18:55:29+00:00","triaged_at":"2026-10-30T18:56:53+00:00","updated_at":"2026-10-30T19:00:01+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T18:56:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"easy.jobs WordPress plugin: stored XSS via cover letter field","impact":"medium","summary":"The easy.jobs WordPress job board plugin does not sanitize the cover_letter field, so an unauthenticated visitor can store a script in a job application. When an administrator opens that candidate's Application tab and clicks the attacker's link, the script runs in the admin's browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","easy-jobs","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Admin browser runs attacker script, leading to admin session takeover","analyst_note":"Sources give no fixed version or vendor advisory; check the plugin's changelog or the wordpress.org listing for a patched release after 2.8.4.","how_to_check":"- Check whether the easy.jobs plugin is installed and its version in the WordPress admin plugin list, or in `wp-content/plugins/` on the server\n- Confirm whether the installed version is `2.8.4` or earlier, which the sources say are affected","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","newer-version"],"who_is_affected":"Sites running the easy.jobs plugin at version 2.8.4 or earlier that accept job applications through its cover letter field. The risk lands on administrators and staff who review candidate applications in the WordPress admin. Sites without the plugin, or running a newer version than 2.8.4, are outside the stated range.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000721,"input_tokens":4273,"output_tokens":588,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources give no fixed version or vendor advisory; check the plugin's changelog or the wordpress.org listing for a patched release after 2.8.4.","search":"'-112365':12A,15A '-2026':11A,14A '2.8.4':111C 'access':140C 'admin':72B 'administr':54B,148C 'affect':152C 'ai':77C 'applic':51B,59B,155C 'arbitrari':129C 'attack':64B,126C,161C 'attacker-craft':160C 'back':174C 'board':31B,82C 'browser':74B 'candid':57B,153C 'career':83C 'click':62B,158C 'collaps':170C 'cover':7A,37B,101C 'craft':162C 'cross':96C 'cross-sit':95C 'cve':10A,13A 'due':112C 'easi':18B 'easy-job':17B 'easy.jobs':1A,28B,76C 'easyjobs':16A 'encod':172C 'escap':119C 'execut':136C,145C,178C 'field':9A,39B 'hire':86C 'host':23B 'includ':110C 'inject':128C,142C 'input':115C 'insuffici':114C 'javascript':176C 'job':19B,30B,50B,79C,81C 'letter':8A,38B,102C 'link':66B,163C 'list':80C 'make':121C 'open':55B,150C 'output':118C 'packag':20B 'page':84C,133C,143C 'paramet':103C 'pars':169C 'payload':180C 'plugin':3A,32B,88C 'point':166C 'possibl':123C 'power':78C 'recruit':85C 'requir':146C 'run':69B 'sanit':35B,116C 'scheme':173C 'script':47B,68B,98C,131C 'self':22B 'self-host':21B 'site':97C 'solut':87C 'store':4A,45B,94C 'success':144C 'tab':60B,156C 'unauthent':24B,42B,125C 'url':168C 'user':139C 'version':106C 'via':6A,99C 'visitor':43B 'vulner':92C 'web':130C 'whatwg':167C 'whenev':137C 'wordpress':2A,25B,29B,90C 'xss':5A,26B","nicknames":[],"mitigations":[],"who_affected":"Sites running the easy.jobs plugin at version 2.8.4 or earlier that accept job applications through its cover letter field. The risk lands on administrators and staff who review candidate applications in the WordPress admin. Sites without the plugin, or running a newer version than 2.8.4, are outside the stated range.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T18:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112365","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112365","severity":null,"published_at":"2026-10-30T18:17:20+00:00","modified_at":"2026-10-30T18:33:26+00:00","first_seen_at":"2026-10-30T18:55:29+00:00","fetched_at":"2026-10-30T18:55:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112365:1188","url":null,"severity":null,"published_at":"2026-10-30T19:00:01+00:00","modified_at":"2026-10-30T19:00:01+00:00","first_seen_at":"2026-10-30T19:00:01+00:00","fetched_at":"2026-10-30T19:00:01+00:00","note":"NVD/Wordfence: cover_letter stored XSS, <=2.8.4. No vendor advisory or changelog could be fetched. WPSec WPSEC-2026-1827 (sibling candidate-URL XSS, same release) says fixed in 2.8.5 on 2026-10-27; assumed same fix, not confirmed for this CVE specifically. Not verified; no exploitation or PoC found. Sibling WPSEC-2026-1828 (pdf.js XSS) also fixed in 2.8.5."}],"documents":[{"id":25346,"url":"https://wpsec.com/vuln/WPSEC-2026-1827/","title":"WPSEC-2026-1827 easy.jobs <= 2.8.4 Stored XSS via candidate-supplied URLs (fixed 2.8.5)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":25347,"url":"https://wordpress.org/plugins/easyjobs/","title":"easy.jobs plugin listing on wordpress.org","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}