A stored cross‑site scripting flaw in the JobWP WordPress plugin allows an attacker to insert malicious scripts into web pages viewed by other users. By failing to neutralize user‑supplied data, the plugin can cause browsers to execute attacker‑controlled code, enabling session hijacking, credential theft, defacement, or the delivery of further malware. This weakness is classified as CWE‑79 and presents a risk to the confidentiality and integrity of site users.

The vulnerability affects the JobWP plugin developed by Hossni Mubarak, in all versions up to and including 2.4.5. Any WordPress site that has this plugin installed and has not upgraded beyond 2.4.5 is potentially exposed.

With a CVSS score of 7.1 the flaw is considered high severity, yet the EPSS score of less than 1 % indicates that exploitation likelihood has been observed to be low. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a stored XSS via input fields or comments within the plugin, requiring an attacker to supply malicious content that is then rendered on visitor pages.