The WP JobHunt plugin allows an authenticated user with Candidate-level or higher permissions to place arbitrary scripts into the job title field, which is subsequently displayed without proper sanitization or escaping. This stored cross‑site scripting flaw permits the execution of user‑controlled code in the browsers of anyone who views the affected job listing, potentially exposing credentials, session data, or other sensitive information to the attacker.

All installations of the WP JobHunt plugin with a version number of 7.6 or lower, including deployments of the JobCareer theme that embed this plugin.

The vulnerability carries a CVSS score of 6.4, indicating a moderate severity, and has an EPSS score of less than 1 %, suggesting that exploitation is currently uncommon. It is not present in the CISA KEV catalog. Exploitation requires the attacker to be authenticated as a Candidate or higher, but once a script is injected it will run for all visitors to the page, giving an attacker the ability to steal session cookies, perform phishing, or compromise the site. The modest EPSS score does not eliminate risk, especially for sites that rely on the plugin and have broad Candidate access.