wp-jobmanager vulnerabilities

Products

• job manager 3

Latest wp-jobmanager CVEs

Newest publication first

1. CVE-2021-39336 Job Manager <= 0.7.25 Authenticated Stored Cross-Site Scripting

   Published 2021-10-15

   Medium·CVSS 4.8 EPSS 0.91%

   The Job Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/admin-jobs.php file which allowed attackers with administrative user access to inject arbitrary web scripts, i...

2. CVE-2012-6713 Job Manager <= 0.7.18 - Cross-Site Scripting

   Published 2019-08-13

   Medium·CVSS 6.1 EPSS 0.92%

   The job-manager plugin before 0.7.19 for WordPress has multiple XSS issues.

3. CVE-2015-6668 Job Manager <= 0.7.25 - Insecure Direct Object Reference

   Published 2017-10-19

   High·CVSS 7.5 EPSS 9.8%

   The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload directory structure, related to an insecure direct object reference.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.