Improper neutralization of user input in the JoomSky JS Job Manager WordPress plugin allows attackers to store malicious scripts that are executed when users view affected job postings. This stored Cross‑Site Scripting (XSS) flaw, identified as CWE‑79, enables an attacker to run code in the context of the site, potentially hijacking user sessions, defacing content, or facilitating phishing attacks.

The vulnerability is present in all releases of the JS Job Manager plugin up to and including version 2.0.2. Users with any of these versions installed on a WordPress site run the JoomSky WordPress plugin and are vulnerable.

The flaw carries a CVSS score of 6.5, indicating moderate severity. The EPSS score of less than 1 % suggests a low likelihood of active exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply malicious input that the plugin stores – either by submitting or editing a job listing or by tricking a legitimate editor into adding content. Once stored, any visitor to the impacted listing will receive the injected script, making all site visitors potentially affected.