The easy.jobs WordPress plugin is affected by a stored cross‑site scripting flaw that originates from the unfiltered 'cover_letter' form field. An unauthenticated attacker can place arbitrary JavaScript code into this field. When an administrator later opens the candidate’s Application tab and clicks an attacker‑crafted link, the browser’s URL parsing collapses the encoded scheme back to "javascript:" and executes the payload in the administrator’s browser context, allowing the attacker to steal session cookies, deface the site, or redirect users. This flaw represents CWE‑79 input validation failure and is a client‑side code injection risk.

Systems running the easy.jobs “AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution” plugin for WordPress with version 2.8.4 or earlier are vulnerable. All WordPress sites that have installed any release up to and including 2.8.4 are at risk through the cover_letter input.

The CVSS score of 7.2 indicates a medium severity, but the lack of a publicly available EPSS score and the absence from the CISA KEV catalog suggest limited exploitation activity so far. The likely attack vector is remote, via the web interface, and requires the attacker to submit a malicious cover_letter value, which is then stored in the database. An attacker must persuade or convince an administrator to click the malicious link before the XSS executes, which imposes a social engineering component on exploitation. Nonetheless, an active administrator viewing the application tab causes the payload to run with the administrator’s privileges, potentially compromising the entire site.