CVE-2026-25340: WordPress Jobmonster theme - SQL Injection (before 4.8.4)

Overview

CVE-2026-25340 describes an improper neutralization of special elements used in an SQL command in the NooTheme Jobmonster theme (noo-jobmonster) for WordPress. The flaw allows blind SQL injection, meaning an attacker can influence database queries without receiving query results directly. The CNA is Patchstack, and the CWE classification is CWE-89.

Impact

• Patchstack assigns a CVSS base score of 9.3 with critical severity, using the vector reported by Patchstack.
• The SSVC record lists technical impact as partial and exploitation as none, and marks the issue as automatable.
• Blind SQL injection can, in general, expose or alter data stored in the database that the site uses. The exact data reachable in this theme is not described in the record.

Affected products and versions

• Product: NooTheme Jobmonster (noo-jobmonster), a WordPress theme.
• The affected-version entry in the record reads as up to and including 4.8.4, while the description and title say before 4.8.4. The record is internally inconsistent on the boundary.
• The lower bound is given as n/a, so the earliest affected version is unknown.
• Operators should treat installations before 4.8.4 as potentially affected and verify the installed version directly.

Exploitation status

• The CISA KEV catalog does not list this CVE in the record, so no confirmed exploitation in the wild is stated by the sources consulted.
• EPSS values are present (probability 0.00294, percentile 0.20881), but these are predictive scores, not evidence of exploitation.

Remediation and mitigation

• Update the Jobmonster theme to version 4.8.4 or a later release from the vendor or a trusted source. The record does not list a fixed version explicitly; 4.8.4 is the boundary given in the title and description.
• If an update cannot be applied immediately, restrict access to the site where possible, review the theme's exposure and consider a web application firewall as a temporary compensating control.
• Keep WordPress core, plugins and other themes updated, and remove unused themes.

Detection guidance

• Inventory WordPress sites that use the noo-jobmonster theme and record installed versions.
• Review web server and application logs for unusual or malformed parameters sent to job listing and search functions, and for database errors or unexpected response timing.
• Check database accounts used by the site for least privilege, so that a successful injection has a limited impact.

Limitations of the available information

• The record does not describe the vulnerable parameter, exact code path or authentication requirements.
• The record does not include an NVD CVSS score; the displayed score comes from the CNA data.
• The affected-version boundary is inconsistent within the record.
• No vendor advisory text beyond the Patchstack database entry was available in the record.

Frequently asked questions

Which versions of the Jobmonster theme are affected by CVE-2026-25340?

The title and description indicate versions before 4.8.4. The affected-version entry in the record is worded differently, so the boundary is inconsistent in the source data. The earliest affected version is not given.

Is CVE-2026-25340 known to be exploited in the wild?

The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted.

What should site owners do now?

Check whether the noo-jobmonster theme is installed, verify its version, and update to 4.8.4 or later from a trusted source. If an update is delayed, consider temporary compensating controls and review logs.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.