The excessive allowance of <script> tags in the WPJOBPORTAL_ALLOWED_TAGS configuration and insufficient sanitization of job descriptions creates a stored XSS vector. Authenticated users with Editor-level or greater privileges can insert arbitrary JavaScript into job postings. When a recipient views a job page containing the injected script, the code runs in the victim’s browser, potentially hijacking sessions, stealing credentials, or performing other malicious actions.

This vulnerability affects WordPress installations that use the WP Job Portal plugin version 2.4.4 or earlier. It is exploitable in multisite deployments, or on sites where the unfiltered_html capability is disabled.

The CVSS score of 4.4 indicates a moderate severity, while the EPSS score of less than 1% suggests low likelihood of exploitation at the time of analysis. The vulnerability has not been listed in the CISA KEV catalog. Because the attacker must already possess Editor‑level credentials, the attack vector is constrained to authenticated sessions, but once in place the injected script allows client‑side code execution and data exfiltration.