CVE-2025-14467 WP Job Portal <= 2.4.4 - Authenticated (Editor+) Stored Cross-Site Scripting via Job Description Field

Q: What is CVE-2025-14467?

CVE-2025-14467 is a medium-severity cross-site scripting vulnerability in wpjobportal WP Job Portal – AI-Powered Recruitment System for Company or Job Board website, published on 12 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Medium 4.4 Published 12 Dec 2025 Updated 8 Apr 2026

Authenticated editors can inject malicious scripts into job descriptions, leading to session hijacking and credential theft in multi-site or unfiltered_html disabled installations.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-14467?

CVE-2025-14467 is a medium-severity cross-site scripting vulnerability in wpjobportal WP Job Portal – AI-Powered Recruitment System for Company or Job Board website, published on 12 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The WP Job Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.4. This is due to the plugin explicitly whitelisting the `<script>` tag in its `WPJOBPORTAL_ALLOWED_TAGS` configuration and using insufficient input sanitization when saving job descriptions. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts into job description fields via the job creation/editing interface. These scripts will execute whenever a user accesses an injected page, enabling session hijacking, credential theft, and other malicious activities.This only impacts multi-site installations, or those with unfiltered_html disabled.

Weakness: CWE-79

Which versions are affected by CVE-2025-14467?

How do I fix CVE-2025-14467?

No fix has been published for CVE-2025-14467 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-14467 being exploited?

There is no known exploitation of CVE-2025-14467 in the wild and no public exploit code.

Sources

Also known as GHSA-85vc-jr29-fm6f.