Live › vulnerability › CVE-2026-116546
The WP Job Portal plugin for WordPress does not sanitize the 'degreetitle' input, so a logged-in user can store a script that runs in other visitors' browsers. An attacker who can register an account on the site can run scripts in the context of users who open the injected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 07:34 UTC. All times on this page are UTC.
Any WordPress site running WP Job Portal up to and including version 2.7.0 is exposed, and the risk is higher where anyone can self-register as an Employer. Sites that do not run this plugin, or that restrict registration and do not have the plugin installed, can skip it.
No product ranges from the sources yet.
2.7.0 are not stated as fixed in the sources; unknownEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WP Job Portal – AI-Powered Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'degreetitle' parameter in all versions up to, and including, 2.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The plugin's self-registration flow allows any visitor to create a Subscriber-backed Employer account, meaning this vulnerability is effectively exploitable by any user who can register on the site.
This page as .md · .json · in your agent: get_signal("CVE-2026-116546")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.