CVE-2026-112365
Deferred Deferred - Pending Action

Stored XSS in Easy.Jobs WordPress Plugin

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: Wordfence

Description
The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cover_letter' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires an administrator to open the affected candidate's Application tab and click the attacker-crafted link, at which point WHATWG URL parsing collapses the encoded scheme back to javascript: and executes the payload.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-112365
EUVD
EUVD-2026-114230

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the easy.jobs WordPress plugin. It allows unauthenticated attackers to inject malicious scripts via the 'cover_letter' parameter due to poor input sanitization and output escaping. The injected scripts execute when an administrator views the candidate's Application tab and clicks a crafted link, which triggers WHATWG URL parsing to execute the payload.

Detection Guidance

This vulnerability can be detected by checking for stored XSS payloads in the 'cover_letter' parameter of the easy.jobs WordPress plugin. Inspect WordPress database tables like wp_posts or wp_postmeta for suspicious JavaScript code in candidate application data. Review server access logs for unusual requests targeting the plugin's endpoints.

Impact Analysis

An attacker could steal sensitive admin session cookies, perform actions on behalf of the admin, or deface the website. This requires an admin to interact with a malicious link, but successful exploitation can lead to unauthorized access, data theft, or malware distribution through the site.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may expose protected health information if admin accounts are compromised. Non-compliance risks include fines, legal action, and reputational damage.

Mitigation Strategies

Immediately update the easy.jobs plugin to the latest version beyond 2.8.4. Disable the plugin temporarily if an update is unavailable. Implement strict input validation for all user-submitted data. Monitor for unauthorized admin actions or script injections in application forms.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112365. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart