CVE-2024-47394

The JobSearch plugin for WordPress fails to properly sanitize user input before including it in web pages, leading to a reflected cross-site scripting (XSS) vulnerability. This affects versions from n/a through 2.5.9 [1].

An attacker can craft a malicious link or form that, when clicked or submitted by a privileged user (e.g., administrator), causes the injected script to execute in the context of the victim's browser. No authentication is required to trigger the vulnerability, but successful exploitation depends on user interaction [1].

Successful exploitation allows an attacker to inject arbitrary HTML and JavaScript, potentially leading to session hijacking, defacement, redirection to malicious sites, or other malicious actions. The vulnerability is expected to be used in mass-exploit campaigns targeting thousands of WordPress sites [1].

The vendor has released version 2.6.1 which patches the issue. Users are strongly advised to update immediately. For those unable to update, Patchstack offers a mitigation rule to block attacks [1].