CVE-2025-69318
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-01-27
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | jobwp | to 2.4.5 (inc) |
| patchstack | jobwp | 2.4.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-69318 is a medium severity Cross Site Scripting (XSS) vulnerability in the WordPress JobWP Plugin versions up to and including 2.4.5. It allows an attacker to inject malicious scripts, such as redirects, advertisements, or other HTML payloads, which execute when site visitors access the compromised pages. This vulnerability falls under the OWASP Top 10 category A3: Injection and specifically involves improper neutralization of input during web page generation (Stored XSS). [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute malicious scripts on your website, potentially leading to unauthorized redirects, displaying unwanted advertisements, or other harmful HTML payloads. This can compromise the user experience, damage your website's reputation, and potentially lead to further security breaches if attackers exploit the vulnerability. Exploitation requires user interaction by a privileged user, such as clicking a malicious link or submitting a crafted form. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves monitoring for attempts to inject malicious scripts into the JobWP plugin pages, especially payloads that execute when site visitors access them. While no specific commands are provided, using web application security scanners or intrusion detection systems that look for Cross Site Scripting (XSS) payloads targeting JobWP plugin versions up to 2.4.5 can help. Additionally, monitoring HTTP requests for suspicious input patterns or unusual form submissions related to the plugin may assist in detection. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the JobWP plugin to version 2.4.6 or later, which contains the fix for this vulnerability. Until the update can be applied, applying the automatic mitigation rule provided by Patchstack to block attacks targeting this vulnerability is recommended. Enabling auto-updates for vulnerable plugins via Patchstack can also help ensure ongoing protection. [1]