---
id: "CVE-2026-116546"
kind: "vulnerability"
aliases: ["CVE-2026-116546"]
title: "WP Job Portal WordPress plugin: stored XSS via degreetitle parameter"
severity: "medium"
cvss: 6.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wp-job-portal"]
not_affected_if: ["plugin-not-installed", "registration-disabled"]
published_at: "2026-10-31T07:16:35+00:00"
first_seen_at: "2026-10-31T07:34:07+00:00"
updated_at: "2026-10-31T07:34:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116546", "first_seen_at": "2026-10-31T07:34:07+00:00"}]
---

# WP Job Portal WordPress plugin: stored XSS via degreetitle parameter

The WP Job Portal plugin for WordPress does not sanitize the 'degreetitle' input, so a logged-in user can store a script that runs in other visitors' browsers. An attacker who can register an account on the site can run scripts in the context of users who open the injected page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the WP Job Portal plugin is installed and its version in the WordPress admin under Plugins.
- Check whether the site allows public self-registration for Employer or subscriber accounts.

## Fix

- Versions above `2.7.0` are not stated as fixed in the sources; unknown

## Timeline

- 2026-10-31T07:34:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116546

## From the sources

The WP Job Portal – AI-Powered Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'degreetitle' parameter in all versions up to, and including, 2.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The plugin's self-registration flow allows any visitor to create a Subscriber-backed Employer account, meaning this vulnerability is effectively exploitable by any user who can register on the site.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_