Vulnerabilidades de Wpjobportal
CVEs publicadas que afetam produtos de Wpjobportal: 8 registro(s), com severidade, exploração e correções.
CVE-2026-65569
Alta · 8.5
CWE-89 06/08/2026
WordPress WP Job Portal plugin <= 2.5.6 - SQL Injection vulnerability
Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions.
CVE-2026-57653
Alta · 8.5
CWE-89 26/06/2026
WordPress WP Job Portal plugin <= 2.5.2 - SQL Injection vulnerability
Contributor SQL Injection in WP Job Portal <= 2.5.2 versions.
CVE-2026-4758
Alta · 8.8
CWE-22 25/03/2026
WP Job Portal <= 2.4.9 - Authenticated (Subscriber+) Arbitrary File Deletion via Resume Custom File Field
The WP Job Portal plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'WPJOBPORTALcustomfields::removeFileCustom' function in all versions up to, and including, 2.4.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVE-2026-4306
Alta · 7.5
CWE-89 23/03/2026
WP Job Portal <= 2.4.8 - Unauthenticated SQL Injection via 'radius' Parameter
The WP Job Portal plugin for WordPress is vulnerable to SQL Injection via the 'radius' parameter in all versions up to, and including, 2.4.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2026-24941
Alta · 7.5
CWE-862 20/02/2026
WordPress WP Job Portal plugin <= 2.4.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through <= 2.4.4.
CVE-2026-24379
Média · 6.5
CWE-639 22/01/2026
WordPress WP Job Portal plugin <= 2.4.3 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through <= 2.4.3.
CVE-2025-14467
Média · 4.4
CWE-79 12/12/2025
WP Job Portal <= 2.4.4 - Authenticated (Editor+) Stored Cross-Site Scripting via Job Description Field
The WP Job Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.4. This is due to the plugin explicitly whitelisting the `<script>` tag in its `WPJOBPORTAL_ALLOWED_TAGS` configuration and using insufficient input sanitization when saving job descriptions. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts into job description fields via the job creation/editing interface. These scripts will execute whenever a user accesses an injected page, enabling session hijacking, credential theft, and other malicious activities.This only impacts multi-site installations, or those with unfiltered_html disabled.
CVE-2025-14293
Média · 6.5
CWE-22 11/12/2025
WP Job Portal <= 2.4.0 - Authenticated (Subscriber+) Arbitrary File Read
The WP Job Portal plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.4.0 via the 'downloadCustomUploadedFile' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.