The flaw is caused by improper neutralization of user input during web page generation in the Ahmad WP Job Portal plugin, enabling a reflected XSS vulnerability. Malicious script injected by an attacker can run in the browser of any user who views a affected page, potentially leading to session hijacking, defacement, or phishing attacks.

All installations of the Ahmad WP Job Portal plugin through version 2.5.1, including earlier releases, are affected. Any WordPress site that has this plugin installed and has not applied the 2.5.2 update is vulnerable.

With a CVSS score of 7.1, the vulnerability is considered high severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. The likely attack vector is reflected XSS: an attacker can craft a URL, HTML form or seemingly innocuous input that, when processed by the plugin, injects executable JavaScript into the page rendered for the victim. No special authentication or network conditions are required, implying that any user who can trigger the vulnerable path is at risk.