What the vulnerability does
01Description
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in JoomSky JS Job Manager plugin <= 2.0.0 versions.
CVE-2023-25963
MEDIUM
CVE-2023-25963: WordPress JS Job Manager Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)
CVSS base score
5.9/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Explanation of Vulnerability in Simple Terms
02Summary
JS Job Manager through version 2.0.0 contains a stored cross-site scripting (XSS) vulnerability. An authenticated administrator can inject malicious scripts that execute in other users' browsers when they view affected pages. The vulnerability requires admin privileges and user interaction to exploit, but can compromise site integrity and steal user data.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that run in other users' browsers and steal their data or perform actions on their behalf.
Potential impact on your site
04Site Impact
A malicious admin can inject scripts that compromise other users' accounts or deface site content.
Conditions required to exploit
05Prerequisites
Attacker must have administrator privileges and the victim must visit a page containing the injected script.
Key dates
06Disclosure timeline
June 16, 2023
CVE published
April 28, 2026
Record updated
External resources
07References
Related vulnerabilities
08Related CVE
CVE-2026-65550 WordPress Tabs plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability
CVE-2026-15464 WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute
CVE-2026-6454 Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute
CVE-2026-15425 Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)
CVE-2026-65511 WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability
