The Custom Field For WP Job Manager plugin exhibits an improper neutralization of input during web page generation, causing user supplied data to be rendered without escaping. This flaw creates a reflected cross‑site scripting vulnerability that can allow an attacker to deliver malicious JavaScript to a victim’s browser. The weakness, classified as CWE‑79, occurs because the plugin does not sanitize the content it displays.

The plugin Custom Field For WP Job Manager from the vendor Theme Funda is affected. All releases up through version 1.3 contain the flaw; there is no indication that earlier releases are vulnerable.

Based on the description, the likely attack vector is an unauthenticated reflected XSS delivered via user‑supplied data that the plugin echoes without sanitization. Attackers can trigger this by supplying malicious payloads in any input that the plugin outputs, and no authentication is required, meaning any visitor to a page that incorporates the plugin could be exposed. With a CVSS score of 7.1 the vulnerability carries medium severity. An EPSS score of < 1% suggests that the likelihood of exploitation is currently low, and the issue is not listed in the CISA KEV catalog.