Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlueGlass Interactive AG Jobs for WordPress job-postings allows Stored XSS.This issue affects Jobs for WordPress: from n/a through <= 2.8.1.
Published: 2025-12-24
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a stored cross‑site scripting flaw caused by improper neutralization of user input during web page generation in the Jobs for WordPress plugin. Malicious content that an attacker can embed into a job posting can be rendered as part of the page viewed by site visitors, allowing the injected script to run in their browsers.

Affected Systems

All installations of BlueGlass Interactive AG's Jobs for WordPress plugin through version 2.8.1 on WordPress websites are affected. The flaw is present in every release from the earliest version up to and including 2.8.1.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity. An EPSS score of less than 1% shows a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. The stored XSS can be triggered by submitting data to a field that is later displayed to any visitor of the site.

Generated by OpenCVE AI on April 29, 2026 at 18:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Jobs for WordPress plugin to a version newer than 2.8.1 if one is available.
  • If no update is available, disable or uninstall the Jobs for WordPress plugin to remove the vulnerable component.
  • Apply site‑wide input sanitization or a web application firewall rule to block script tags in job posting data while a patch is pending.

Generated by OpenCVE AI on April 29, 2026 at 18:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlueGlass Interactive AG Jobs for WordPress job-postings allows Stored XSS.This issue affects Jobs for WordPress: from n/a through <= 2.7.17. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlueGlass Interactive AG Jobs for WordPress job-postings allows Stored XSS.This issue affects Jobs for WordPress: from n/a through <= 2.8.1.
Title WordPress Jobs for WordPress plugin <= 2.7.17 - Cross Site Scripting (XSS) vulnerability WordPress Jobs for WordPress plugin <= 2.8.1 - Cross Site Scripting (XSS) vulnerability

Tue, 20 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
References

Mon, 29 Dec 2025 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Blueglass
Blueglass jobs For Wordpress
Wordpress
Wordpress wordpress
Vendors & Products Blueglass
Blueglass jobs For Wordpress
Wordpress
Wordpress wordpress

Wed, 24 Dec 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 24 Dec 2025 13:15:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlueGlass Interactive AG Jobs for WordPress job-postings allows Stored XSS.This issue affects Jobs for WordPress: from n/a through <= 2.7.17.
Title WordPress Jobs for WordPress plugin <= 2.7.17 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References

Subscriptions

Blueglass Jobs For Wordpress
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:14:31.280Z

Reserved: 2025-12-19T10:20:05.495Z

Link: CVE-2025-68597

cve-icon Vulnrichment

Updated: 2025-12-24T18:45:29.284Z

cve-icon NVD

Status : Deferred

Published: 2025-12-24T13:16:27.177

Modified: 2026-04-27T19:16:35.400

Link: CVE-2025-68597

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-29T18:30:17Z

Weaknesses