CVE-2025-22679
Published: 03 February 2025
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Job Board Manager job-board-manager allows Reflected XSS.This issue affects Job Board Manager: from n/a through <= 2.1.61.
Security Summary
CVE-2025-22679 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the PickPlugins Job Board Manager (job-board-manager) WordPress plugin. This issue affects Job Board Manager versions from n/a through <= 2.1.61.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Attackers require no privileges and can exploit it remotely over the network with low attack complexity, though it demands user interaction such as clicking a malicious link. Exploitation changes the security scope, enabling script execution in the victim's browser context and resulting in low impacts to confidentiality, integrity, and availability.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/job-board-manager/vulnerability/wordpress-job-board-manager-plugin-2-1-60-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)