CVE-2021-39328 Simple Job Board <= 2.9.4 Authenticated Stored Cross-Site Scripting

What is CVE-2021-39328?

CVE-2021-39328 is a medium-severity cross-site scripting vulnerability in Simple Job Board, published on 21 Oct 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The Simple Job Board WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $job_board_privacy_policy_label variable echo'd out via the ~/admin/settings/class-simple-job-board-settings-privacy.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 2.9.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.

Weakness: CWE-79

Which versions are affected by CVE-2021-39328?

It affects 1 product.

Products include Presstigers Simple Job Board.

How do I fix CVE-2021-39328?

No fix has been published for CVE-2021-39328 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-39328 being exploited?

There is no known exploitation of CVE-2021-39328 in the wild and no public exploit code.

Other vulnerabilities in Simple Job Board

• CVE-2024-1813 Simple Job Board <= 2.11.0 - Unauthenticated PHP Object Injection via Job Application Fields Critical 9.8
• CVE-2024-7351 Simple Job Board <= 2.12.3 - Authenticated (Editor+) PHP Object Injection High 7.2
• CVE-2024-7761 Simple Job Board < 2.12.2 - Admin+ Stored XSS Medium 6.1
• CVE-2017-18498 Cross-site scripting in n/a Medium 6.1
• CVE-2023-47188 WordPress Simple Job Board plugin <= 2.10.5 - Broken Access Control vulnerability Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w65v-xjgq-w8fr.