CVE-2026-42685: WordPress WP Job Portal plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad WP Job Portal allows Reflected XSS. This issue affects WP Job Portal: from n/a through 2.5.1.
Metrics
- CVSS v3.1
- 7.1
- Severity
- HIGH
- Fixed in
- —
- Affected Products
- 1
HarborGuard Analysis
Synopsis
Reflected cross-site scripting (XSS) in the WP Job Portal WordPress plugin (versions up to and including 2.5.1) allows an unauthenticated attacker to inject malicious scripts into server responses. The vulnerability is reachable over the network and requires no prior authentication; a victim must be tricked into clicking a crafted link that carries the malicious payload. Successful exploitation enables script execution in the victim's browser, which can be used to read session data, alter page content, or disrupt the victim's browsing session. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.
HarborGuard Coverage
Detection for CVE-2026-42685 is available across every HarborGuard environment; the CVE is ingested from upstream feeds including the Patchstack advisory within minutes of publication and matched against customer images, including custom-built WordPress images that bundle WP Job Portal. Any image running an affected version (2.5.1 or earlier) is flagged automatically during both registry scans and active pipeline builds.
AvailableHarborGuard surfaces this finding with its CVSS v3.1 score of 7.1 (HIGH) and applies each customer environment's compliance policy weighting before routing the alert to the appropriate team inbox. Per-environment context, such as whether the affected image is exposed to public traffic, is factored into prioritization so the right owners receive it without noise.
AvailableBecause no upstream fix version has been published for this CVE, HarborGuard re-checks the advisory on every ingest cycle and will make a patched-image rebuild available the moment a fix is released. For customers who opt into auto-remediation, the rebuild, regression test run, and PR against affected workloads will be triggered automatically at that point without requiring manual intervention.
Pending upstreamExploit Conditions
- Network reachabilityRequired
The attacker must be able to reach the target WordPress site over the network and deliver a crafted URL to a victim who interacts with it.
- AuthenticationNot required
No account or credentials are needed; the malicious request can be sent by any unauthenticated party.
- Victim interactionRequired
The attack depends on social engineering: a victim must click a specially crafted link that carries the reflected payload.
- Attack complexityDetail
Exploitation is reliable and condition-free once the victim clicks the link; no race conditions or special environmental factors are required.
Blast Radius
- An attacker can read the victim's browser session tokens, cookies, and any sensitive data rendered on the page at the time of execution.
- An attacker can modify page content visible to the victim, injecting fake login forms or fraudulent UI elements.
- With scope change (S:C in the CVSS vector), the injected script can interact with resources outside the WP Job Portal component, broadening access within the same browser origin.
- The victim's browsing session on the affected site can be disrupted or hijacked, for example by forcibly redirecting them to an attacker-controlled page.
How HarborGuard Handles This
Available on HarborGuard: scanning for CVE-2026-42685 is active now, and any image containing WP Job Portal 2.5.1 or earlier will be flagged in both registry and pipeline scans. Because no fix version has been published yet, HarborGuard monitors the Patchstack advisory and NVD feed on every ingest cycle. The moment an upstream patch ships, a patched-image rebuild will become available; for customers who opt into auto-remediation, HarborGuard will run the rebuild, execute regression tests, and open a pull request against affected workloads automatically. In the interim, recommended compensating controls include applying a web application firewall rule to strip or encode unvalidated query parameters before they reach WordPress, restricting public exposure of the affected plugin's endpoints via network policy where possible, and reviewing whether the plugin is actively needed in production images.
- Ahmad / WP Job Portal≤ 2.5.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L