CVE-2025-7781: WP JobHunt Plugin XSS Vulnerability

CVE-2025-7781 Overview

CVE-2025-7781 is a stored Cross-Site Scripting (XSS) vulnerability in the WP JobHunt plugin for WordPress, which is bundled with the JobCareer theme. The flaw affects all versions up to and including 7.6. It resides in the cs_job_title parameter, which lacks sufficient input sanitization and output escaping. Authenticated users holding Candidate-level access or higher can inject arbitrary web scripts into pages. The injected scripts execute in the browser of any user who accesses the affected page, enabling session theft, content manipulation, or redirection to attacker-controlled resources [CWE-79].

Critical Impact
Authenticated Candidate-level attackers can inject persistent JavaScript that executes against every visitor of affected job listing pages.

Affected Products

WP JobHunt plugin for WordPress (all versions ≤ 7.6)
JobCareer WordPress theme (bundles WP JobHunt)
WordPress sites exposing job submission workflows to Candidate-level users

Discovery Timeline

2025-10-10 - CVE-2025-7781 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7781

Vulnerability Analysis

The WP JobHunt plugin exposes the cs_job_title parameter during job posting and profile-editing workflows. The plugin accepts input from authenticated users without applying WordPress sanitization helpers such as sanitize_text_field() on write, and without escaping the value with esc_html() or esc_attr() when rendering it back into the page.

Because the field is stored in the database and rendered on public-facing pages, injected payloads persist across sessions and affect every user who views the page. Attackers can exploit the flaw to hijack administrator sessions, pivot to account takeover, or serve malicious redirects to job seekers browsing the site.

The vulnerability requires only Candidate-level privileges, which many job board deployments allow via open self-registration. This lowers the barrier to exploitation significantly compared to XSS flaws requiring editor or administrator access.

Root Cause

The root cause is missing input sanitization on submission and missing output escaping on rendering for the cs_job_title field. WordPress provides context-aware escaping functions, but the plugin does not apply them consistently to this parameter, allowing raw HTML and JavaScript to pass through the storage-to-render pipeline.

Attack Vector

An attacker registers or uses an existing Candidate-level account. They then submit a job title containing a JavaScript payload through the plugin's frontend or dashboard form. When any user, including administrators, visits the page displaying the job title, the browser parses and executes the payload in the site's origin context.

See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-7781

Indicators of Compromise

Job listings containing <script>, onerror=, onload=, or javascript: strings in the title field
Unexpected outbound requests from administrator browsers after viewing job listing pages
New administrator accounts or modified user roles following visits to attacker-created listings
Database entries in wp_posts or plugin-specific tables with HTML tags inside cs_job_title values

Detection Strategies

Query the WordPress database for job title fields containing HTML or JavaScript syntax markers
Review web server access logs for POST requests to job submission endpoints followed by suspicious GET traffic
Deploy a Web Application Firewall (WAF) rule to flag script-like content in cs_job_title request parameters
Correlate Candidate-role account creations with subsequent job submissions containing anomalous payloads

Monitoring Recommendations

Monitor WordPress audit logs for job listing creation and edit events by low-privilege accounts
Alert on Content Security Policy (CSP) violations reported by administrator browsers
Track unusual session activity for administrator accounts, including token reuse from unexpected IPs

How to Mitigate CVE-2025-7781

Immediate Actions Required

Update the WP JobHunt plugin to a version newer than 7.6 once a vendor patch is available
Restrict Candidate-level self-registration to trusted email domains or require manual approval
Audit existing job listings for stored payloads and purge any containing script content
Force password resets and session invalidation for administrator accounts that visited affected pages

Patch Information

At the time of publication, the vendor advisory referenced by Wordfence covers all versions through 7.6. Site operators should consult the JobCareer theme listing on ThemeForest for updated releases and apply patches promptly.

Workarounds

Deploy a WAF rule that blocks HTML tags and JavaScript event handlers in cs_job_title parameter values
Implement a strict Content Security Policy that disallows inline scripts on job listing pages
Temporarily disable public Candidate registration until the plugin is patched
Manually review and sanitize all pending job submissions before publication

bash

# Example WAF rule (ModSecurity syntax) to block script content in cs_job_title
SecRule ARGS:cs_job_title "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1007781,phase:2,deny,status:403,msg:'CVE-2025-7781 XSS attempt in cs_job_title'"