CVE-2026-116546

Name of the Vulnerable Software and Affected Versions WP Job Portal – AI-Powered Recruitment System for Company or Job Board website versions prior to 2.7.1

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts via the degreetitle parameter. These scripts execute when a user accesses the affected page. Because the self-registration flow allows any visitor to create a Subscriber-backed Employer account, the issue is exploitable by any user capable of registering on the site.

Recommendations Update to a version newer than 2.7.0. Avoid using the degreetitle parameter until the update is applied.