Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
71 results · page 2 of 2
Sep 3, 2024WP Job Portal – A Complete Recruitment System for Company or Job Board website: Local File Inclusion, Arbitrary Settings Update, and User CreationCVE-2024-7950 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Local File Inclusion, Arbitrary Settings Update, and User Creation in all versions up to, and including, 2.1.6 via several functions called by the 'checkFormRequest' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Attackers can also update arbitrary settings and create user accounts even when registration is disabled, leading to user creation with a default role of Administrator.
- Product
- WP Job Portal – A Complete Recruitment System for Company or Job Board website
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 24, 2024Simple Job Board: PHP Object InjectionCVE-2024-7351 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.3 via deserialization of untrusted input when editing job applications. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- Product
- Simple Job Board
- Affected
- up to 2.12.3
- What to do
- Affects up to 2.12.3. Update Simple Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 20, 2024Job Board Manager: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-38722 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PickPlugins Job Board Manager allows Stored XSS.This issue affects Job Board Manager: from n/a through 2.1.57.
- Product
- Job Board Manager
- Affected
- up to 2.1.57
- What to do
- Affects up to 2.1.57. Update Job Board Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 9, 2024Simple Job Board: PHP Object InjectionCVE-2024-1813 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.11.0 via deserialization of untrusted input in the job_board_applicant_list_columns_value function. This makes it possible for unauthenticated attackers to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code when a submitted job application is viewed.
- Product
- Simple Job Board
- Affected
- up to 2.11.0
- What to do
- Affects up to 2.11.0. Update Simple Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 21, 2024Simple Job Board: Unauthorized access of data|CVE-2024-0593 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Simple Job Board plugin for WordPress is vulnerable to unauthorized access of data| due to insufficient authorization checking on the fetch_quick_job() function in all versions up to, and including, 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be password protected or private and contain sensitive information.
- Product
- Simple Job Board
- Affected
- up to 2.10.8
- What to do
- Affects up to 2.10.8. Update Simple Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 17, 2024WP Job Portal – A Complete Job Board: Missing AuthorizationCVE-2022-41786 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Job Portal WP Job Portal – A Complete Job Board.This issue affects WP Job Portal – A Complete Job Board: from n/a through 2.0.1.
- Product
- WP Job Portal – A Complete Job Board
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update WP Job Portal – A Complete Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 15, 2024easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg: Does not properly secure some of its AJAX actionsCVE-2023-6843 · WordPress plugins & themes · reported by WPScanMedium 4.3
The easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg WordPress plugin before 2.4.7 does not properly secure some of its AJAX actions, allowing any logged-in users to modify its settings.
- Product
- easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg
- Fixed in
- 2.4.7
- What to do
- Update easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg to 2.4.7 or newer.
Jan 5, 2024Simple Job Board: Cross-Site Request Forgery (CSRF)CVE-2023-52122 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board.This issue affects Simple Job Board: from n/a through 2.10.6.
- Product
- Simple Job Board
- Affected
- up to 2.10.6
- What to do
- Affects up to 2.10.6. Update Simple Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 5, 2024WP Job Portal – A Complete Job Board: Cross-Site Request Forgery (CSRF)CVE-2023-52184 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Job Portal WP Job Portal – A Complete Job Board.This issue affects WP Job Portal – A Complete Job Board: from n/a through 2.0.6.
- Product
- WP Job Portal – A Complete Job Board
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update WP Job Portal – A Complete Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023Job Manager & Career – Manage job board listings, and recruitments: Cross-Site Request Forgery (CSRF), Deserialization of Untrusted DataCVE-2023-51545 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career – Manage job board listings, and recruitments.This issue affects Job Manager & Career – Manage job board listings, and recruitments: from n/a through 1.4.4.
- Product
- Job Manager & Career – Manage job board listings, and recruitments
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Job Manager & Career – Manage job board listings, and recruitments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 21, 2023WordPress Job Board and Recruitment Plugin – JobWP: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-48288 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.This issue affects WordPress Job Board and Recruitment Plugin – JobWP: from n/a through 2.1.
- Product
- WordPress Job Board and Recruitment Plugin – JobWP
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update WordPress Job Board and Recruitment Plugin – JobWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 20, 2023WordPress Job Board and Recruitment Plugin – JobWP: Unrestricted Upload of File with Dangerous TypeCVE-2023-29384 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.This issue affects WordPress Job Board and Recruitment Plugin – JobWP: from n/a through 2.0.
- Product
- WordPress Job Board and Recruitment Plugin – JobWP
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update WordPress Job Board and Recruitment Plugin – JobWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board plugin <= 2.10.3 versions.CVE-2023-29440 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board plugin <= 2.10.3 versions.
- Affected
- up to 2.10.3
- What to do
- Affects up to 2.10.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 6, 2023JobSearch WP Job Board: Authorization bypassCVE-2021-4364 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_add_job_import_schedule_call() function in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers to add and/or modify schedule calls.
- Product
- JobSearch WP Job Board
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update JobSearch WP Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwpscan.com
Jun 6, 2023JobSearch WP Job Board: Authorization bypassCVE-2021-4361 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_job_integrations_settin_save AJAX action in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers to update arbitrary options on the site.
- Product
- JobSearch WP Job Board
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update JobSearch WP Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwpscan.com
Jun 6, 2023JobSearch WP Job Board: Authorization bypassCVE-2021-4352 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the save_locsettings function in versions up to, and including, 1.8.1. This makes it possible for unauthenticated attackers to change the settings of the plugin.
- Product
- JobSearch WP Job Board
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update JobSearch WP Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwpscan.com
May 1, 2023A vulnerability classified as problematic was found in BestWebSoft Job Board Plugin 1.0.0 on WordPress.CVE-2014-125100 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in BestWebSoft Job Board Plugin 1.0.0 on WordPress. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is dbb71deee071422ce3e663fbcdce3ad24886f940. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227764.
- Affected
- 1.0.0 to 1.0.0
- What to do
- Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2022Simple Job Board: Is susceptible to Directory ListingCVE-2022-2558 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple Job Board WordPress plugin before 2.10.0 is susceptible to Directory Listing which allows the public listing of uploaded resumes in certain configurations.
- Product
- Simple Job Board
- Fixed in
- 2.10.0
- What to do
- Update Simple Job Board to 2.10.0 or newer.
Aug 22, 2022Ninja Job Board: Does not protect the directory where it stores uploaded resumesCVE-2022-2544 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ninja Job Board WordPress plugin before 1.3.3 does not protect the directory where it stores uploaded resumes, making it vulnerable to unauthenticated Directory Listing which allows the download of uploaded resumes.
- Product
- Ninja Job Board
- Fixed in
- 1.3.3
- What to do
- Update Ninja Job Board to 1.3.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Oct 21, 2021Simple Job Board: Stored Cross-Site ScriptingCVE-2021-39328 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Simple Job Board WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $job_board_privacy_policy_label variable echo'd out via the ~/admin/settings/class-simple-job-board-settings-privacy.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 2.9.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- Simple Job Board
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update Simple Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 15, 2021Job Board Vanila: Stored Cross-Site ScriptingCVE-2021-39334 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Job Board Vanila WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via the psjb_exp_in and the psjb_curr_in parameters found in the ~/job-settings.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- Job Board Vanila
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Job Board Vanila to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.