CVE-2026-18063

The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'positionbutton' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

EUVD-2026-78304

The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'positionbutton' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-18063 Job Postings <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position_button' Parameter

The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'positionbutton' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-18063 Job Postings <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position_button' Parameter

The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'positionbutton' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-18063

The Job Postings plugin for WordPress (all versions up to and including 2.8.1 ) is vulnerable to Stored Cross-Site Scripting via the position_button parameter in class-job-add-edit.php, due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level ac...

PT-2026-91876

The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'position button' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-18063: Improper Neutralization of Input During Web Page Generation

The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'positionbutton' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-23806

Missing Authorization vulnerability in BlueGlass Interactive AG Jobs for WordPress job-postings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Jobs for WordPress: from n/a through = 2.8...

CVE-2026-23806

CVE-2026-23806 corresponds to a Missing Authorization / Broken Access Control vulnerability in the WordPress plugin Jobs for WordPress, affecting versions through 2.8. The issue arises from incorrectly configured access control security levels, potentially enabling unauthorized access or actions ...

PT-2026-27841

Name of the Vulnerable Software and Affected Versions Jobs for WordPress versions through 2.8 Description An authorization issue exists in BlueGlass Interactive AG Jobs for WordPress job postings. This allows exploitation of incorrectly configured access control security levels. Recommendations...

CVE-2026-24036

Horilla HRMS (versions 1.4.0 and above) exposes unpublished job postings via the unauthenticated /recruitment/recruitment-details// endpoint. The underlying issue allows viewing draft job titles, descriptions, and application links, revealing internal hiring information and potentially causing ca...

CVE-2026-24036

Horilla is a free and open source Human Resource Management System HRMS. Versions 1.4.0 and above expose unpublished job postings through the /recruitment/recruitment-details// endpoint without authentication. The response includes draft job titles, descriptions and application link allowing...

EUVD-2025-205238

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BlueGlass Interactive AG Jobs for WordPress job-postings allows Stored XSS.This issue affects Jobs for WordPress: from n/a through = 2.7.17...

CVE-2025-68597

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BlueGlass Interactive AG Jobs for WordPress job-postings allows Stored XSS.This issue affects Jobs for WordPress: from n/a through = 2.8.1...

CVE-2025-68597: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BlueGlass Interactive AG Jobs for WordPress job-postings allows Stored XSS.This issue affects Jobs for WordPress: from n/a through = 2.8.1...

CVE-2025-50050: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BlueGlass Interactive AG Jobs for WordPress job-postings allows Stored XSS.This issue affects Jobs for WordPress: from n/a through = 2.7.14...

CVE-2024-10105

The Job Postings WordPress plugin before 2.7.11 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10105

The Job Postings WordPress plugin before 2.7.11 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10105

The Job Postings WordPress plugin versions prior to 2.7.11 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain plugin settings. This allows high-privilege users, such as those with contributor status, to execute XSS attacks ev...

CVE-2024-10105 Jobs for WordPress < 2.7.11 - Contributor+ Stored XSS

The Job Postings WordPress plugin before 2.7.11 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...