CVE-2026-22339: WordPress WPJobster theme <= 6.3.5 - Reflected Cross Site Scripting (XSS) vulnerability

Synopsis

Reflected cross-site scripting (XSS) affects the WPJobster WordPress theme in versions 6.3.5 and earlier. The vulnerability is reachable over the network without any authentication, but requires a victim to follow a crafted link that carries the malicious payload. Successful exploitation lets an attacker execute arbitrary JavaScript in the victim's browser session, enabling session token theft, page content tampering, and degradation of the affected page. No fix version has been published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target WordPress site over the network to deliver the crafted URL to the victim.

• AuthenticationNot required

  No account or credentials are needed; the reflected payload can be triggered by any unauthenticated visitor following a malicious link.

• Victim interactionRequired

  The attack requires the victim to click or follow a specially crafted link that carries the XSS payload, making social engineering a necessary step.

• Attack complexityDetail

  Exploit reliability is high and no special environmental conditions, race conditions, or configuration states are required to trigger the vulnerability.

Blast Radius

• Reads session cookies or authentication tokens from the victim's browser, enabling account hijacking without needing credentials.
• Injects or alters visible page content in the victim's browser session, enabling phishing payloads or misleading UI elements.
• Initiates browser-side requests on behalf of the logged-in victim, potentially performing actions within the WordPress admin or marketplace interface.
• Degrades the victim's experience of the affected page, consistent with the CVSS availability impact rating.