The vulnerability allows an authenticated user with contributor-level access to inject malicious scripts into the 'icon' attribute of the easyjobs/job-list Gutenberg block. The object does not sanitize or escape this attribute, so any script placed there is stored and later rendered in the page output. When another visitor accesses that page, the script runs in the visitor's browser, exposing them to data theft, session hijacking, or defacement. The flaw stems from CWE‑79, an unescaped output weakness.

WordPress sites using the easy.jobs plugin published by wpdevteam. All releases up to and including version 2.8.2 are affected. Both the public plugin page and various editor blocks rely on the insecure 'icon' attribute.

The CVSS score of 6.4 indicates a moderate severity. EPSS is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, implying that widespread exploitation has not yet been observed. Nonetheless, an attacker who is able to obtain contributor or higher credentials can exploit this stored XSS via the WordPress admin interface, inserting payloads that execute on every user who views the affected job‑list page. The attack vector is limited to authenticated access, but given that contributor accounts are common in content‑heavy environments, the risk surface is broad.