The VK Google Job Posting Manager plugin for WordPress allows an authenticated author or higher to store arbitrary JavaScript in the job description field because the input is not properly sanitized or escaped before rendering. When a user views an affected job post, the injected script executes with the context of the site, potentially enabling code execution in the visitor’s browser, data theft, or session hijacking.

Vektor‑Inc’s VK Google Job Posting Manager WordPress plugin, versions up to and including 1.2.23, is affected. No other product or version is listed.

The vulnerability has a CVSS score of 6.4, indicating a moderate severity. The EPSS score is below 1%, implying a low to very low probability of exploitation in the near term. It is not listed in the CISA KEV catalog, and exploitation requires the attacker to have author‑level or higher permissions and to trick another user into viewing the injected job description.