CVE-2025-13383

The Job Board by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.1. This is due to the plugin storing the entire unsanitized `$_GET` superglobal array directly into the database via `update_user_meta()` when users save search results, and later outputting this data without proper escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses the saved search or views their profile, granted they can trick the user into performing the search and saving the results.

• CWE-79

• https://plugins.trac.wordpress.org/browser/job-board/tags/1.2.1/job-board.php#L1680
• https://plugins.trac.wordpress.org/browser/job-board/tags/1.2.1/job-board.php#L2354
• https://plugins.trac.wordpress.org/browser/job-board/tags/1.2.1/job-board.php#L2355
• https://plugins.trac.wordpress.org/changeset/3403205/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1eb1622f-19fb-472e-871b-9a456f80f390?source=cve

Published

Nov 25, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-13378The AI ChatBot with ChatGPT and Content Generator by AYS plu…6.5
• CVE-2025-13379IBM Aspera Console 3.4.0 through 3.4.8 is vulnerable to SQL …8.6
• CVE-2025-1338A vulnerability was found in NUUO Camera up to 20250203. It …7.3
• CVE-2025-13380The AI Engine for WordPress: ChatGPT, GPT Content Generator …6.5
• CVE-2025-13381The AI ChatBot with ChatGPT and Content Generator by AYS plu…5.3
• CVE-2025-13382The Frontend File Manager Plugin for WordPress is vulnerable…4.3
• CVE-2025-13384The CP Contact Form with PayPal plugin for WordPress is vuln…7.5
• CVE-2025-13385The Bookme – Free Online Appointment Booking and Scheduling …4.9
• CVE-2025-13386The Social Images Widget plugin for WordPress is vulnerable …5.3
• CVE-2025-13387The Kadence WooCommerce Email Designer plugin for WordPress …7.2
• CVE-2025-13389The Admin and Customer Messages After Order for WooCommerce:…5.3
• CVE-2025-1339A vulnerability was found in TOTOLINK X18 9.1.0cu.2024_B2022…8.8