CVE-2025-8318

MediumCVSS 6.4

Published: 11/09/2025(UTC)Updated: 30/09/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

Stored XSS vulnerability in Jobify plugin for WordPress (up to 1.4.4) via the 'keyword' parameter due to insufficient input sanitization and output escaping. Allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.

Risk Assessment

Risk of user session hijacking, data theft, or malicious code propagation within the WordPress site context.

Recommendation

Update the plugin to the latest version and implement proper input sanitization and output escaping mechanisms.

Other vulnerabilities in Jobify

CVE-2026-57336High
The Jobify plugin version 4.3.2 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.

Original NVD description (English source)

The Jobify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘keyword’ parameter in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS