PT-2025-48008 · WordPress+1 · Wordpress+1

Jamshed Yergashvoyev · Published 2025-11-25 · Updated 2025-11-25 · CVE-2025-13383

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Job Board by BestWebSoft plugin for WordPress versions up to and including 1.2.1

Description The plugin is susceptible to Stored Cross-Site Scripting. The issue arises from storing unsanitized data from the $ GET superglobal array directly into the database using the update user meta() function when users save search results. This data is then output without proper escaping, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts execute when a user accesses the saved search or views their profile, provided the attacker can induce the user to save the search results. The vulnerability allows for the injection of malicious scripts via the $ GET parameters.

Recommendations Update the Job Board by BestWebSoft plugin to a version beyond 1.2.1.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-13383

Affected Products

Job Board

Wordpress

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-13383 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/1eb1622f-19fb-472e-871b-9a456f80f390?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1993281552155853220 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3403205 · Note
• https://plugins.trac.wordpress.org/browser/job-board/tags/1.2.1/job-board.php#L2354 · Note
• https://twitter.com/CVEnew/status/1993225835042791620 · Twitter Post
• https://plugins.trac.wordpress.org/browser/job-board/tags/1.2.1/job-board.php#L1680 · Note
• https://t.me/CVEtracker/38171 · Telegram Post
• https://plugins.trac.wordpress.org/browser/job-board/tags/1.2.1/job-board.php#L2355 · Note