{"id":"CVE-2026-116546","kind":"vulnerability","aliases":["CVE-2026-116546"],"related":[],"title":"WP Job Portal WordPress plugin: stored XSS via degreetitle parameter","description":"The WP Job Portal – AI-Powered Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'degreetitle' parameter in all versions up to, and including, 2.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The plugin's self-registration flow allows any visitor to create a Subscriber-backed Employer account, meaning this vulnerability is effectively exploitable by any user who can register on the site.","summary":"The WP Job Portal plugin for WordPress does not sanitize the 'degreetitle' input, so a logged-in user can store a script that runs in other visitors' browsers. An attacker who can register an account on the site can run scripts in the context of users who open the injected page.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-job-portal"],"not_affected_if":["plugin-not-installed","registration-disabled"],"how_to_check":"- Check whether the WP Job Portal plugin is installed and its version in the WordPress admin under Plugins.\n- Check whether the site allows public self-registration for Employer or subscriber accounts.","fix":"- Versions above `2.7.0` are not stated as fixed in the sources; unknown","status":"open","published_at":"2026-10-31T07:16:35+00:00","first_seen_at":"2026-10-31T07:34:07+00:00","triaged_at":"2026-10-31T07:34:41+00:00","updated_at":"2026-10-31T07:34:41+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T07:34:41Z","model":"claude-haiku-5-5","output":{"fix":"- Versions above `2.7.0` are not stated as fixed in the sources; unknown","reach":"internet","title":"WP Job Portal WordPress plugin: stored XSS via degreetitle parameter","impact":"medium","summary":"The WP Job Portal plugin for WordPress does not sanitize the 'degreetitle' input, so a logged-in user can store a script that runs in other visitors' browsers. An attacker who can register an account on the site can run scripts in the context of users who open the injected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-job-portal","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Scripts run in other users' browsers, enabling session theft or actions as them.","analyst_note":"","how_to_check":"- Check whether the WP Job Portal plugin is installed and its version in the WordPress admin under Plugins.\n- Check whether the site allows public self-registration for Employer or subscriber accounts.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","registration-disabled"],"who_is_affected":"Any WordPress site running WP Job Portal up to and including version 2.7.0 is exposed, and the risk is higher where anyone can self-register as an Employer. Sites that do not run this plugin, or that restrict registration and do not have the plugin installed, can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000695,"input_tokens":4251,"output_tokens":539,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116546':13A,16A '-2026':12A,15A '2.7.0':115C 'access':135C,151C 'account':61B,172C 'ai':83C 'ai-pow':82C 'allow':162C 'arbitrari':140C 'attack':56B,130C 'authent':129C 'back':170C 'board':91C 'browser':54B 'compani':88C 'context':70B 'creat':166C 'cross':101C 'cross-sit':100C 'cve':11A,14A 'degreetitl':9A,37B,106C 'due':116C 'effect':177C 'employ':171C 'escap':123C 'execut':147C 'exploit':178C 'flow':161C 'host':20B 'includ':114C 'inject':76B,139C,153C 'input':38B,119C 'insuffici':118C 'job':2A,24B,28B,80C,90C 'level':134C 'log':42B 'logged-in':41B 'make':125C 'mean':173C 'open':74B 'output':122C 'packag':17B 'page':77B,144C,154C 'paramet':10A,107C 'plugin':5A,30B,93C,156C 'portal':3A,25B,29B,81C 'possibl':127C 'power':84C 'recruit':85C 'regist':59B,184C 'registr':160C 'run':50B,66B 'sanit':35B,120C 'script':48B,67B,103C,142C 'self':19B,159C 'self-host':18B 'self-registr':158C 'site':64B,102C,187C 'store':6A,46B,99C 'subscrib':133C,169C 'subscriber-back':168C 'subscriber-level':132C 'system':86C 'user':44B,72B,150C,181C 'version':110C 'via':8A,104C 'visitor':53B,164C 'vulner':97C,175C 'web':141C 'websit':92C 'whenev':148C 'wordpress':4A,21B,32B,95C 'wp':1A,23B,27B,79C 'wp-job-port':22B 'xss':7A","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running WP Job Portal up to and including version 2.7.0 is exposed, and the risk is higher where anyone can self-register as an Employer. Sites that do not run this plugin, or that restrict registration and do not have the plugin installed, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T07:16:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116546","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116546","severity":null,"published_at":"2026-10-31T07:16:35+00:00","modified_at":"2026-10-31T07:16:35+00:00","first_seen_at":"2026-10-31T07:34:07+00:00","fetched_at":"2026-10-31T07:34:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}