CVE-2025-24550: JobScore Job Manager Stored XSS Vulnerability

CVE-2025-24550 Overview

CVE-2025-24550 is a stored Cross-Site Scripting (XSS) vulnerability in the JobScore Job Manager WordPress plugin (job-manager-by-jobscore). The flaw affects all versions up to and including 2.2. Attackers with low-privileged authenticated access can inject malicious scripts that persist in the plugin's stored content. When an administrator or other user views the affected page, the injected payload executes in the victim's browser session. The vulnerability is tracked under CWE-79 for Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to steal session cookies, hijack administrator accounts, or pivot to full site compromise through browser-side script execution.

Affected Products

JobScore Job Manager plugin for WordPress (job-manager-by-jobscore)
All versions from initial release through 2.2
WordPress sites with the plugin installed and active

Discovery Timeline

2025-04-17 - CVE-2025-24550 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24550

Vulnerability Analysis

The JobScore Job Manager plugin fails to properly sanitize user-supplied input before rendering it within web page output. An authenticated attacker with contributor-level or similar low privileges can submit crafted input containing JavaScript payloads. The plugin stores this input without applying output encoding or contextual escaping. When a page containing the malicious data is rendered, the browser executes the injected script in the context of the site's origin.

The attack requires user interaction, meaning a victim must load or interact with the page containing the stored payload. Because the flaw has scope change characteristics, execution can affect resources beyond the vulnerable component itself, including administrator sessions.

Root Cause

The root cause is missing or insufficient input neutralization in one or more plugin fields that accept user input. The plugin does not apply WordPress sanitization functions such as sanitize_text_field() on input, nor escaping functions such as esc_html() or esc_attr() on output. This allows raw HTML and JavaScript to be stored in the database and later rendered inline in generated pages.

Attack Vector

Exploitation occurs over the network against the WordPress administrative interface or public-facing job management pages. The attacker authenticates with a low-privileged account, submits a payload through a vulnerable input field, and waits for a higher-privileged user to view the affected content. Refer to the Patchstack Vulnerability Report for additional technical context.

No public proof-of-concept exploit is currently listed for this CVE, and it is not present in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-24550

Indicators of Compromise

Unexpected <script>, <img onerror=>, or <svg onload=> tags stored in job listing fields, applicant fields, or plugin-managed metadata
Outbound requests from administrator browsers to unknown external domains shortly after loading plugin pages
New unauthorized WordPress administrator accounts or modified user roles following administrator page views

Detection Strategies

Inspect the WordPress database tables associated with job-manager-by-jobscore for HTML or JavaScript characters (<, >, javascript:) in fields intended for plain text
Review web server access logs for POST requests to plugin endpoints containing script tags or URL-encoded payloads such as %3Cscript%3E
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution on plugin pages

Monitoring Recommendations

Enable WordPress audit logging to record all content submissions and user role changes
Monitor for administrator session anomalies, including logins from new geolocations or unusual user agents
Alert on modifications to plugin, theme, or core WordPress files that follow administrator activity on plugin pages

How to Mitigate CVE-2025-24550

Immediate Actions Required

Deactivate the JobScore Job Manager plugin until a patched version above 2.2 is confirmed available and installed
Audit all existing job listings and plugin-managed content for stored script payloads and remove any suspicious entries
Rotate credentials and session tokens for all WordPress administrator accounts on affected sites

Patch Information

The advisory lists affected versions through 2.2 with no fixed version explicitly identified at publication. Site administrators should consult the Patchstack Vulnerability Report and the WordPress plugin repository for the latest version. Apply updates immediately once a patched release is published.

Workarounds

Restrict contributor and author registration to trusted users only, reducing the pool of accounts that can submit stored payloads
Deploy a Web Application Firewall (WAF) rule that blocks HTML tags and JavaScript event handlers in requests to plugin endpoints
Enforce a strict Content Security Policy that disallows inline scripts on WordPress admin and job listing pages

bash

# Example nginx WAF-style rule to block script tags in plugin POST requests
location ~* /wp-admin/admin(-ajax|-post)\.php {
    if ($request_body ~* "(<script|javascript:|onerror=|onload=)") {
        return 403;
    }
}