CVE-2025-14467

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14467", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-10T16:11:47.862Z", "datePublished": "2025-12-12T03:20:39.179Z", "dateUpdated": "2026-04-08T16:35:02.464Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:35:02.464Z"}, "affected": [{"vendor": "wpjobportal", "product": "WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.3.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Job Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.4. This is due to the plugin explicitly whitelisting the `<script>` tag in its `WPJOBPORTAL_ALLOWED_TAGS` configuration and using insufficient input sanitization when saving job descriptions. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts into job description fields via the job creation/editing interface. These scripts will execute whenever a user accesses an injected page, enabling session hijacking, credential theft, and other malicious activities.This only impacts multi-site installations, or those with unfiltered_html disabled."}], "title": "WP Job Portal <= 2.4.4 - Authenticated (Editor+) Stored Cross-Site Scripting via Job Description Field", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0c347b9f-d297-4cb5-9c4a-1001d845ed5a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.3.9/includes/constants.php#L351"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-job-portal/trunk/includes/constants.php#L351"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-job-portal/trunk/modules/job/model.php#L1278"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.3.9/modules/job/model.php#L1278"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-job-portal/trunk/modules/job/tmpl/views/frontend/title.php#L231"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.3.9/modules/job/tmpl/views/frontend/title.php#L231"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Long Nguyen"}], "timeline": [{"time": "2026-02-14T06:40:02.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-11T15:05:46.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T18:08:38.949270Z", "id": "CVE-2025-14467", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T18:17:14.870Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14467", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-15T18:08:38.949270Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T18:08:41.077Z"}}], "cna": {"title": "WP Job Portal <= 2.4.4 - Authenticated (Editor+) Stored Cross-Site Scripting via Job Description Field", "credits": [{"lang": "en", "type": "finder", "value": "Long Nguyen"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wpjobportal", "product": "WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.3.9"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-14T06:40:02.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-11T15:05:46.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0c347b9f-d297-4cb5-9c4a-1001d845ed5a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.3.9/includes/constants.php#L351"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-job-portal/trunk/includes/constants.php#L351"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-job-portal/trunk/modules/job/model.php#L1278"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.3.9/modules/job/model.php#L1278"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-job-portal/trunk/modules/job/tmpl/views/frontend/title.php#L231"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.3.9/modules/job/tmpl/views/frontend/title.php#L231"}], "descriptions": [{"lang": "en", "value": "The WP Job Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.4. This is due to the plugin explicitly whitelisting the `<script>` tag in its `WPJOBPORTAL_ALLOWED_TAGS` configuration and using insufficient input sanitization when saving job descriptions. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts into job description fields via the job creation/editing interface. These scripts will execute whenever a user accesses an injected page, enabling session hijacking, credential theft, and other malicious activities.This only impacts multi-site installations, or those with unfiltered_html disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:35:02.464Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14467", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:35:02.464Z", "dateReserved": "2025-12-10T16:11:47.862Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-12T03:20:39.179Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website", "vendor": "wpjobportal", "versions": [{"lessThanOrEqual": "2.3.9", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Job Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.4. This is due to the plugin explicitly whitelisting the `<script>` tag in its `WPJOBPORTAL_ALLOWED_TAGS` configuration and using insufficient input sanitization when saving job descriptions. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts into job description fields via the job creation/editing interface. These scripts will execute whenever a user accesses an injected page, enabling session hijacking, credential theft, and other malicious activities.This only impacts multi-site installations, or those with unfiltered_html disabled."}, {"lang": "es", "value": "El plugin WP Job Portal para WordPress es vulnerable a Cross-Site Scripting Almacenado en todas las versiones hasta la 2.3.9, inclusive. Esto se debe a que el plugin incluye expl\u00edcitamente en su lista blanca la etiqueta '<script>' en su configuraci\u00f3n 'WPJOBPORTAL_ALLOWED_TAGS' y utiliza una sanitizaci\u00f3n de entrada insuficiente al guardar las descripciones de los puestos de trabajo. Esto hace posible que atacantes autenticados, con acceso de nivel Editor o superior, inyecten scripts web arbitrarios en los campos de descripci\u00f3n de los puestos de trabajo a trav\u00e9s de la interfaz de creaci\u00f3n/edici\u00f3n de puestos de trabajo. Estos scripts se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada, lo que permite el secuestro de sesi\u00f3n, el robo de credenciales y otras actividades maliciosas. Esto solo afecta a instalaciones multisitio o a aquellas con 'unfiltered_html' deshabilitado."}], "id": "CVE-2025-14467", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14467", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-15T18:08:38.949270Z", "version": "2.0.3"}}]}, "published": "2025-12-12T04:15:50.450", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.3.9/includes/constants.php#L351"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.3.9/modules/job/model.php#L1278"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.3.9/modules/job/tmpl/views/frontend/title.php#L231"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-job-portal/trunk/includes/constants.php#L351"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-job-portal/trunk/modules/job/model.php#L1278"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-job-portal/trunk/modules/job/tmpl/views/frontend/title.php#L231"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0c347b9f-d297-4cb5-9c4a-1001d845ed5a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T20:51:56.908360+00:00", "value": {"mitigation_remediation": ["Update WP Job Portal to a version newer than 2.4.4 where the <script> tag is removed from the allowed tags list", "If an immediate update is not possible, remove the <script> entry from the plugin\u2019s allowed tags configuration or apply a custom content filter that strips script tags from job descriptions before rendering", "Tighten role permissions by restricting Editor and above users from editing job description content or by moving job posting creation to a separate, less privileged role"], "summary": {"action": "Upgrade Plugin", "impact": "Stored Cross\u2011Site Scripting allowing authenticated users with Editor or greater privileges to inject and execute arbitrary scripts via the job description field"}, "threat_synthesis": {"affected_systems": "This vulnerability affects WordPress installations that use the WP Job Portal plugin version 2.4.4 or earlier. It is exploitable in multisite deployments, or on sites where the unfiltered_html capability is disabled.", "description_and_impact": "The excessive allowance of <script> tags in the WPJOBPORTAL_ALLOWED_TAGS configuration and insufficient sanitization of job descriptions creates a stored XSS vector. Authenticated users with Editor-level or greater privileges can insert arbitrary JavaScript into job postings. When a recipient views a job page containing the injected script, the code runs in the victim\u2019s browser, potentially hijacking sessions, stealing credentials, or performing other malicious actions.", "risk_and_exploitability": "The CVSS score of 4.4 indicates a moderate severity, while the EPSS score of less than 1% suggests low likelihood of exploitation at the time of analysis. The vulnerability has not been listed in the CISA KEV catalog. Because the attacker must already possess Editor\u2011level credentials, the attack vector is constrained to authenticated sessions, but once in place the injected script allows client\u2011side code execution and data exfiltration."}}}}, "created": "2025-12-12T08:48:20.002346+00:00", "updated": "2026-04-22T21:00:06.359303+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpjobportal", "wpjobportal$PRODUCT$wp_job_portal"]}