The vulnerability allows an attacker to store malicious scripts that run when a user views a page generated by the workable_jobs shortcode. Due to missing input sanitization and output escaping on shortcode attributes, any contributor or higher can inject scripts. The impact is that scripts run in the context of the site, potentially leaking user cookies, defacing content, or executing further attacks.

The issue is present in the Workable Api WordPress plugin from miriamgoldman. All releases up to and including version 1.0.4 are affected. Users running any of these versions on a WordPress installation may be vulnerable.

The CVSS v3 score of 6.4 indicates moderate severity. The EPSS score of less than 1% shows a low likelihood of exploitation at present. Since the flaw requires contributor-level authentication, the attacker must have legitimate user access. The vulnerability is not listed in the CISA KEV catalog. If privileged accounts are exposed or social engineering is used to gain contributor access, the stored scripts could be delivered to visitors, leading to data theft or site takeover.