CVE-2026-12395
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The WP Job Portal WordPress plugin before version 2.5.5 fails to properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with a subscriber-level (self-registerable) account to perform SQL injection attacks.
Risk Assessment
An attacker can extract, modify, or delete data from the WordPress database, including user data and content, leading to a breach of confidentiality and integrity of the system.
Recommendation
Immediately update the WP Job Portal plugin to version 2.5.5 or later, which includes a fix that eliminates the SQL injection vulnerability.
Other vulnerabilities in WP Job Portal
See all- CVE-2026-57653High
The WP Job Portal plugin version 2.5.2 and earlier contains a SQL injection vulnerability in the Contributor module. This allows an attacker to manipulate database queries.
- CVE-2026-42684Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ahmad WP Job Portal allows Blind SQL Injection. This issue affects WP Job Portal from n/a through 2.5.1.
- CVE-2026-81299Medium
The WP Job Portal plugin in versions 2.5.9 and earlier has an Insecure Direct Object References (IDOR) vulnerability for subscribers. Subscriber-level users can access objects (e.g., data) without authorization.
- CVE-2026-65569High
Subscriber SQL Injection in WP Job Portal versions up to 2.5.6.
- CVE-2026-12397Medium
The WP Job Portal WordPress plugin before version 2.5.5 does not verify ownership when returning an employer's contact email for a given job, allowing authenticated users with a subscriber-level (self-registerable) account to read other employers' private account email addresses by enumerating job identifiers.
- CVE-2026-12396Medium
The WP Job Portal WordPress plugin before version 2.5.5 does not perform capability or ownership checks before allowing job moderation actions, allowing authenticated users with a subscriber-level (self-registerable) account to approve, feature, or reject arbitrary jobs, including those owned by other users.
- CVE-2026-48880Medium
The WP Job Portal plugin versions up to 2.5.2 contain a Cross Site Scripting (XSS) vulnerability that can be exploited by subscribers.
- CVE-2026-42685High
The WP Job Portal plugin by Ahmad versions up to 2.5.1 has a Reflected XSS vulnerability due to improper input neutralization during page generation. An attacker can inject malicious script via a crafted URL, which executes in the victim's browser.
Original NVD description (English source)
The WP Job Portal WordPress plugin before 2.5.5 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with a subscriber-level (self-registerable) account to perform SQL injection attacks.