Improper neutralization of input in the Greenhouse Job Board WordPress plugin creates a DOM‑based XSS flaw that permits an attacker to inject malicious script into pages served to users. By exploiting this vulnerability a malicious actor could directly execute code within the victim’s browser session, potentially allowing session hijacking, credential theft, or defacement of the site. The weakness is an input validation failure documented as CWE‑79.

The flaw is present in the brownbagmarketing Greenhouse Job Board plugin version 2.7.3 and earlier. It is not limited to a specific WordPress theme or server configuration but affects any WordPress installation using any of those plugin versions.

The CVSS score of 5.9 indicates moderate risk, while the EPSS score of <1% suggests exploitation is unlikely at present. The vulnerability is not listed in CISA KEV. The likely attack vector is an unauthenticated user visiting a crafted URL that causes the plugin to embed unsanitized content into the page. Attack requires only that an attacker can persuade a user to load the malicious link, making social engineering a viable method.