CVE-2025-53201

The Jobmonster theme for WordPress, developed by NooTheme, contains a reflected cross-site scripting (XSS) vulnerability due to improper neutralization of user input during web page generation. This flaw affects all versions from n/a through 4.7.8. [1]

An attacker can exploit this vulnerability by crafting a malicious URL containing the XSS payload. Successful exploitation requires a privileged user, such as an administrator, to click the crafted link or visit a specially prepared page. The vulnerability is considered moderately dangerous and is expected to be leveraged in mass-exploit campaigns targeting numerous websites. [1]

If exploited, the attacker can inject arbitrary HTML and JavaScript into the victim's browser session. This could result in redirecting users to malicious sites, injecting unwanted advertisements, or performing other actions within the context of the affected website. [1]

The vendor has addressed the issue in version 4.7.9 of the theme. Users are strongly advised to update to this patched version immediately. For those unable to update immediately, Patchstack provides a mitigation rule to block attacks until the update can be applied. [1]