The NooTheme Jobmonster theme contains an improper neutralization of input during page generation that allows stored cross‑site scripting. A malicious actor can embed JavaScript in data fields such as job listings or other content that the theme saves to the database. When other users view the affected pages, the embedded script executes in their browsers, giving the attacker the ability to hijack sessions, deface pages, or perform other malicious actions within the victim’s context.

All WordPress sites that employ the NooTheme Jobmonster theme at version 4.8.0 or earlier are vulnerable. This includes every installation regardless of the operating system, hosting platform, or additional plugins, as the flaw resides solely in the theme’s rendering logic.

With a CVSS score of 6.5 the vulnerability is rated moderate severity. The EPSS score is below 1%, indicating a very low likelihood that the flaw is currently being exploited in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a stored XSS attack that requires the attacker to submit malicious content through a content creation or editing interface, which typically demands authenticated user capabilities, often administrative levels. Once the payload is stored, any subsequent page view by a user will trigger the script, exposing the site to widespread client‑side compromise.