This vulnerability is an Improper Neutralization of Input During Web Page Generation that permits reflected cross‑site scripting via the PickPlugins Job Board Manager plugin. The flaw allows an attacker to inject malicious script into a page that is displayed to a user after the user requests a specially crafted URL or input value. Once the script runs in the victim’s browser, it could, based on common XSS consequences, lead to session hijacking or other malicious activity; this is an inference not explicitly stated in the CVE data. The weakness is catalogued as CWE‑79.

The affected system is the PickPlugins Job Board Manager WordPress plugin, versions from its initial release through 2.1.61. Any WordPress installation that has this plugin version installed is at risk.

The CVSS score of 7.1 indicates a high severity. The EPSS score of less than 1% suggests the likelihood of exploitation is currently low, and the flaw is not listed in the CISA KEV catalog. The attack vector is remote, requiring an attacker to supply crafted input (likely via URL parameters) that is reflected back in the generated page. Although exploitation is considered unlikely at present, once exploited it would provide attackers the ability to compromise user sessions or deface web pages.