The Jobify plugin for WordPress is vulnerable to a stored Cross‑Site Scripting flaw through the unchecked ‘keyword’ request parameter. Insufficient input sanitization and output escaping allow an authenticated user with Contributor privileges or higher to embed malicious scripts that will run whenever a user views the affected page.

WordPress plugin Jobify, version 1.4.4 and earlier, developed by bmarshall511.

The flaw carries a CVSS score of 6.4 and an EPSS score of less than 1% – indicating a moderate severity but low probability of exploitation. The vulnerability requires authentication and only users with Contributor-level or higher access can exploit it, limiting the attack surface yet still enabling potentially widespread client‑side damage if an attacker gains or leverages such privileges. The plugin is not listed in CISA KEV, suggesting no publicly known exploitation, but the impact to end users remains significant should the flaw be abused.