CVE-2025-50050

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the BlueGlass Interactive AG Jobs for WordPress plugin (job-postings). The plugin fails to properly neutralize input during web page generation, allowing attackers to inject arbitrary scripts that are saved and later executed when visitors view affected job postings [1].

Exploitation requires a privileged user (such as an administrator) to perform an action like clicking a malicious link or visiting a crafted page. This interaction enables the attacker to inject scripts, which then execute in the context of other users' browsers [1].

If exploited, an attacker can inject malicious scripts such as redirects, advertisements, or other HTML payloads. These scripts execute when guests visit the site, potentially leading to data theft, defacement, or further compromise [1].

The vulnerability affects all versions up to and including 2.7.14. A patch is available in version 2.7.15. Users are advised to update immediately or enable auto-update via Patchstack. Although the vendor rates the severity as low, the CVSS v3 score of 6.5 (Medium) indicates a notable risk [1].