CVE-2026-57336

HighCVSS 7.1

Published: 29/06/2026(UTC)Updated: 25/10/2026(UTC)Translated: 30/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The Jobify plugin version 4.3.2 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.

Risk Assessment

The risk involves the execution of arbitrary JavaScript in the victim's browser, potentially leading to session theft, redirects to malicious sites, or theft of sensitive data.

Recommendation

Immediately update the Jobify plugin to a version newer than 4.3.2. If no update is available, temporarily disable the plugin.

Other vulnerabilities in Jobify

CVE-2025-8318Medium
Stored XSS vulnerability in Jobify plugin for WordPress (up to 1.4.4) via the 'keyword' parameter due to insufficient input sanitization and output escaping. Allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Jobify <= 4.3.2 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS