This vulnerability arises from improper neutralization of input during web page generation. As a result, a malicious actor can embed and return arbitrary JavaScript code that is executed in the victim’s browser. The weakness is a classic cross‑site scripting flaw (CWE‑79), enabling actions such as cookie theft, session hijacking, defacement or redirection to malicious sites. The plugin fails to escape or validate user‑supplied data that is reflected back to the page, creating a direct path for script injection.

WordPress sites that have the eyecix JobSearch plugin installed in any version up to and including 3.2.0 are vulnerable. This includes any deployment that has not yet upgraded to the newer releases that contain the fix. Sites relying on older versions of the plugin remain at risk.

Based on the description, it is inferred that the attack can be performed by delivering a specially crafted URL or form input that is reflected by the plugin’s output. The EPSS score (< 1%) indicates a very low, but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The flaw is known to be high risk due to its ease of exploitation and broad impact. Because the vulnerability is client‑side, an attacker only needs to entice a user to visit the carefully constructed link; authentication or elevated privileges are not required.