BaseFortify

Publication date: 2025-10-10

Last updated on: 2025-10-14

Assigner: Wordfence

Description

The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to Stored Cross-Site Scripting via the ‘cs_job_title’ parameter in all versions up to, and including, 7.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Candidate-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-10

Last Modified

2025-10-14

Generated

2026-07-06

AI Q&A

2025-10-10

EPSS Evaluated

2026-07-05

NVD

CVE-2025-7781

EUVD

EUVD-2025-33710

Affected Vendors & Products

Vendor	Product	Version / Range
wp_jobhunt	wp_jobhunt	*
wordpress	wordpress	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the WP JobHunt plugin for WordPress, specifically via the 'cs_job_title' parameter. It occurs because the plugin does not properly sanitize or escape input, allowing authenticated users with Candidate-level access or higher to inject malicious scripts that execute when other users view the affected pages.

Impact Analysis

An attacker with Candidate-level access or above can inject malicious scripts into pages, which will execute in the browsers of users who visit those pages. This can lead to theft of user credentials, session hijacking, defacement, or other malicious actions performed on behalf of the victim user.

Hi! I’m here to help you understand CVE-2025-7781. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70