CVE-2025-8318

Vulnerability

Description The Jobify plugin for WordPress versions up to and including 1.4.4 contains a stored cross-site scripting (XSS) vulnerability in the 'keyword' parameter. The plugin fails to properly sanitize user input and escape output, enabling attackers to inject arbitrary web scripts [1].

Exploitation

To exploit this vulnerability, an attacker must be authenticated with at least Contributor-level access. They can supply crafted input to the 'keyword' parameter, which is stored and later displayed without adequate sanitization. When other users, including administrators, visit the affected page, the injected script executes in their browsers.

Impact

Successful exploitation allows attackers to perform actions such as session hijacking, defacing the site, redirecting users to malicious sites, or stealing sensitive information. The injected script runs in the context of the victim's browser, potentially compromising the entire WordPress installation.

Mitigation

As of the publication date, users should upgrade to a patched version of Jobify if available, or apply input validation and output escaping as a workaround. The vendor may have released a fix in a version newer than 1.4.4.