The vulnerability is an improper neutralization of input during page generation, allowing an attacker to inject malicious script content that is stored in the database and served to other users when they view job listings. Based on the description, the likely attack vector involves input fields used for job posting content, where injected scripts are stored and later rendered. This stored XSS can lead to session hijacking, defacement, or the execution of arbitrary client‑side code if injected content is rendered within a web page.

WordPress Job Manager plugin by JobScore, any installation using version 2.2 or older, including all prior releases

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% signals a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would typically target the plugin’s job posting or content input fields to inject script payloads, based on the description – the exact fields are not explicitly enumerated. Successful exploitation requires that the injected content be rendered in a page that visitors or administrators load, making the risk more pronounced for sites with active job listings or administrative users who access the plugin’s interface.