---
id: "CVE-2026-112365"
kind: "vulnerability"
aliases: ["CVE-2026-112365"]
title: "easy.jobs WordPress plugin: stored XSS via cover letter field"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "easyjobs", "fixed": ["2.8.5"], "affected": "<= 2.8.4", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["easy-jobs", "package", "self-hosted", "unauthenticated", "wordpress", "xss"]
not_affected_if: ["newer-version", "plugin-not-installed"]
published_at: "2026-10-30T18:17:20+00:00"
first_seen_at: "2026-10-30T18:55:29+00:00"
updated_at: "2026-10-30T19:00:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112365", "first_seen_at": "2026-10-30T18:55:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T19:00:01+00:00"}]
---

# easy.jobs WordPress plugin: stored XSS via cover letter field

The easy.jobs WordPress job board plugin does not sanitize the cover_letter field, so an unauthenticated visitor can store a script in a job application. When an administrator opens that candidate's Application tab and clicks the attacker's link, the script runs in the admin's browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:easyjobs affected <= 2.8.4 fixed 2.8.5

## How to check

- WordPress admin > Plugins: find easy.jobs (slug easyjobs); version 2.8.4 or earlier is affected
- Or read the Version header in wp-content/plugins/easyjobs/easyjobs.php
- Review stored applications for cover_letter content containing links with odd schemes (e.g. java&#10;script:, encoded javascript:)

## Fix

Update easy.jobs to 2.8.5 or later (per WPSec; not yet confirmed on the vendor changelog)

## Timeline

- 2026-10-30T18:55:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112365
- 2026-10-30T19:00:01+00:00 analyst — NVD/Wordfence: cover_letter stored XSS, <=2.8.4. No vendor advisory or changelog could be fetched. WPSec WPSEC-2026-1827 (sibling candidate-URL XSS, same release) says fixed in 2.8.5 on 2026-10-27; assumed same fix, not confirmed for this CVE specifically. Not verified; no exploitation or PoC found. Sibling WPSEC-2026-1828 (pdf.js XSS) also fixed in 2.8.5.

## Documents

- [describes] WPSEC-2026-1827 easy.jobs <= 2.8.4 Stored XSS via candidate-supplied URLs (fixed 2.8.5) https://wpsec.com/vuln/WPSEC-2026-1827/
- [mentions] easy.jobs plugin listing on wordpress.org https://wordpress.org/plugins/easyjobs/

## From the sources

The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cover_letter' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires an administrator to open the affected candidate's Application tab and click the attacker-crafted link, at which point WHATWG URL parsing collapses the encoded scheme back to javascript: and executes the payload.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_