PT-2026-4565 · WordPress · Vk Google Job Posting Manager

Athiwat Tiprasaharn · CVE-2025-12836 · Publicado 2026-01-24 · Atualizado 2026-01-24

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions VK Google Job Posting Manager plugin for WordPress versions up to and including 1.2.20

Description The VK Google Job Posting Manager plugin for WordPress is susceptible to Stored Cross-Site Scripting through the Job Description field. Insufficient input sanitization and output escaping of user-supplied attributes allows authenticated attackers with author-level permissions or higher to inject arbitrary web scripts. These scripts will execute when a user accesses the affected page.

Recommendations Update the VK Google Job Posting Manager plugin to a version newer than 1.2.20.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-12836

Produtos afetados

Vk Google Job Posting Manager

Referências · 8

• https://plugins.trac.wordpress.org/browser/vk-google-job-posting-manager/tags/1.2.20/vk-google-job-posting-manager.php#L419 · Nota
• https://plugins.trac.wordpress.org/browser/vk-google-job-posting-manager/tags/1.2.20/vk-google-job-posting-manager.php#L468 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/4e0fd492-19ee-430e-a495-99ad28043bf9?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-12836 · Nota de Segurança
• https://t.me/cveNotify/149779 · Publicação no Telegram
• https://plugins.trac.wordpress.org/changeset/3449302 · Nota
• https://twitter.com/CVEnew/status/2014995791333806217 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2015044862949663058 · Publicação no Twitter