The vulnerability arises because the Job Board by BestWebSoft plugin stores the entire unsanitized $_GET superglobal array in user meta data via update_user_meta(). When a user later views the saved search or profile, this data is rendered without escaping, allowing arbitrary JavaScript injection. An attacker can craft a GET request containing malicious code, trick a victim into performing a search and saving it, and then the script executes in the victim’s browser, potentially stealing session cookies, defacing content, or redirecting users to phishing sites. The flaw does not allow direct server‑side code execution; its impact is limited to the victim’s browser context.

WordPress installations using the Job Board by BestWebSoft plugin version 1.2.1 or earlier are affected. No additional vendor or product versions are listed, but any version up to and including 1.2.1 shares the same insecure logic.

The CVSS score of 6.1 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not currently listed in CISA’s KEV catalog. The likely attack vector requires an unauthenticated attacker to manipulate a target user’s GET parameters and rely on that user to perform a search and save it; the attack does not involve direct authentication or phishing of the attacker’s own credentials. The risk remains significant for sites that commonly allow users to save searches, as an attacker could inject a large number of malicious scripts hidden within stored data.