WordPress security by component

WP Job Portal

Plugin description

WP Job Portal adds job listings, employer and applicant profiles, applications, resumes, and recruitment management features to WordPress.

WP Job Portal (wp-job-portal) is a WordPress plugin with 44 published CVE records in this archive. The latest tracked vulnerability was published Oct 29, 2026; the highest published CVSS base score is 9.8.

Plugin slug: wp-job-portal

Latest vulnerability

CVE-2026-22386: WP Job Portal: Missing authorization

Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.1. The CNA vector requires low-privilege authenticated access; the exact WordPress role is not disclosed. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. The precise affected operation and resulting application-level impact are not described beyond the vulnerability class. The structured affected range is <= 2.7.1.

PublishedOct 29, 2026

Known safe version2.7.2

Published vulnerabilities for wp-job-portal
		Safe version
Oct 29, 2026	CVE-2026-22386 WP Job Portal: Missing authorization Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.1. The CNA vector requires low-privilege authenticated access; the exact WordPress role is not disclosed. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. The precise affected operation and resulting application-level impact are not described beyond the vulnerability class. The structured affected range is <= 2.7.1.	2.7.2	CVE4.3
Aug 28, 2026	CVE-2026-81299 WP Job Portal lets Subscribers modify another user's object WP Job Portal through 2.5.9 accepts a Subscriber-controlled object reference without enforcing ownership. A Subscriber can target another user's protected job-portal object and perform an unauthorized change.	2.6.0	CVE4.3
Aug 06, 2026	CVE-2026-65569 WP Job Portal permits Subscriber-level SQL injection WP Job Portal through 2.5.6 permits SQL injection by an authenticated Subscriber or higher. Attacker-controlled input reaches a database query without safe parameterization, but. The issue can expose or alter database data within the database user's permissions.	2.5.7	CVE8.5
Jul 16, 2026	CVE-2026-12395 WP Job Portal: SQL injection WP Job Portal is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is < 2.5.5.	2.5.5	CVE6.5
Jul 13, 2026	CVE-2026-12397 WP Job Portal: Broken access control WP Job Portal is affected by broken access control. Exposure depends on how the affected operation is made reachable by the site. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is < 2.5.5.	2.5.5	CVE4.3
Jul 13, 2026	CVE-2026-12396 WP Job Portal: A security weakness WP Job Portal is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 2.5.5.	2.5.5	CVE5.4
Jun 26, 2026	CVE-2026-57653 WP Job Portal: SQL injection WP Job Portal is affected by SQL injection. Exploitation requires an authenticated contributor account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 2.5.2.	2.5.3	CVE8.5
Jun 15, 2026	CVE-2026-48880 WP Job Portal: Cross-site scripting WP Job Portal is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 2.5.2.	2.5.3	CVE6.5
Jun 02, 2026	CVE-2026-42685 WP Job Portal: Cross-site scripting WP Job Portal is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 2.5.1.	2.5.2	CVE7.1
Jun 02, 2026	CVE-2026-42684 WP Job Portal: SQL injection WP Job Portal is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 2.5.1.	2.5.2	CVE9.3
Mar 26, 2026	CVE-2026-4758 WP Job Portal – AI-Powered Recruitment System for Company or Job Board website: Code execution WP Job Portal – AI-Powered Recruitment System for Company or Job Board website is affected by code execution. Exploitation requires an authenticated subscriber account. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is <= 2.4.9.	See mitigation notes	CVE8.8
Mar 23, 2026	CVE-2026-4306 WP Job Portal – AI-Powered Recruitment System for Company or Job Board website: SQL injection WP Job Portal – AI-Powered Recruitment System for Company or Job Board website is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 2.4.8.	2.5.7 (confirmed by; first fixed release not established)	CVE7.5
Feb 20, 2026	CVE-2026-24941 WP Job Portal: A security weakness WP Job Portal is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE7.5
Jan 22, 2026	CVE-2026-24379 WP Job Portal: A security weakness WP Job Portal is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.5
Dec 12, 2025	CVE-2025-14467 WP Job Portal: Cross-site scripting WP Job Portal is affected by cross-site scripting. Exploitation requires an authenticated editor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.4
Dec 11, 2025	CVE-2025-14293 WP Job Portal: Filesystem traversal WP Job Portal is affected by filesystem traversal. Exploitation requires an authenticated subscriber account. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE6.5
Jun 17, 2025	CVE-2025-48274 WP Job Portal: SQL injection WP Job Portal is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE9.3
May 23, 2025	CVE-2025-48273 WP Job Portal: Filesystem traversal WP Job Portal is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE7.5
May 23, 2025	CVE-2025-47438 WP Job Portal: Filesystem traversal WP Job Portal is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE8.1
May 19, 2025	CVE-2025-48272 WP Job Portal: A security weakness WP Job Portal is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3
Feb 25, 2025	CVE-2025-26935 WP Job Portal: Filesystem traversal WP Job Portal is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE7.5
Feb 22, 2025	CVE-2024-13873 WP Job Portal – A Complete Recruitment System for Company or Job Board website: Broken access control WP Job Portal – A Complete Recruitment System for Company or Job Board website is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role.	See mitigation notes	CVE4.3
Feb 01, 2025	CVE-2024-13429 WP Job Portal – A Complete Recruitment System for Company or Job Board website: Broken access control WP Job Portal – A Complete Recruitment System for Company or Job Board website is affected by broken access control. Exploitation requires an authenticated WordPress account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role.	See mitigation notes	CVE4.3
Feb 01, 2025	CVE-2024-13428 WP Job Portal – A Complete Recruitment System for Company or Job Board website: Broken access control WP Job Portal – A Complete Recruitment System for Company or Job Board website is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role.	See mitigation notes	CVE5.3
Feb 01, 2025	CVE-2024-13425 WP Job Portal – A Complete Recruitment System for Company or Job Board website: Broken access control WP Job Portal – A Complete Recruitment System for Company or Job Board website is affected by broken access control. Exploitation requires an authenticated WordPress account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role.	See mitigation notes	CVE4.3
Feb 01, 2025	CVE-2024-13372 WP Job Portal – A Complete Recruitment System for Company or Job Board website: Broken access control WP Job Portal – A Complete Recruitment System for Company or Job Board website is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role.	See mitigation notes	CVE5.3
Feb 01, 2025	CVE-2024-13371 WP Job Portal – A Complete Recruitment System for Company or Job Board website: A security weakness WP Job Portal – A Complete Recruitment System for Company or Job Board website is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3
Jan 07, 2025	CVE-2024-12131 WP Job Portal – A Complete Recruitment System for Company or Job Board website: Broken access control WP Job Portal – A Complete Recruitment System for Company or Job Board website is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role.	See mitigation notes	CVE4.3
Jan 03, 2025	CVE-2024-12132 WP Job Portal – A Complete Recruitment System for Company or Job Board website: Broken access control WP Job Portal – A Complete Recruitment System for Company or Job Board website is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role.	See mitigation notes	CVE4.3
Dec 14, 2024	CVE-2024-11715 WP Job Portal – A Complete Recruitment System for Company or Job Board website: A security weakness WP Job Portal – A Complete Recruitment System for Company or Job Board website is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.8
Dec 14, 2024	CVE-2024-11714 WP Job Portal – A Complete Recruitment System for Company or Job Board website: SQL injection WP Job Portal – A Complete Recruitment System for Company or Job Board website is affected by SQL injection. Exploitation requires an authenticated administrator account. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE4.9
Dec 14, 2024	CVE-2024-11713 WP Job Portal – A Complete Recruitment System for Company or Job Board website: SQL injection WP Job Portal – A Complete Recruitment System for Company or Job Board website is affected by SQL injection. Exploitation requires an authenticated administrator account. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE4.9
Dec 14, 2024	CVE-2024-11712 WP Job Portal – A Complete Recruitment System for Company or Job Board website: A security weakness WP Job Portal – A Complete Recruitment System for Company or Job Board website is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3
Dec 14, 2024	CVE-2024-11711 WP Job Portal – A Complete Recruitment System for Company or Job Board website: SQL injection WP Job Portal – A Complete Recruitment System for Company or Job Board website is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE7.5
Dec 14, 2024	CVE-2024-11710 WP Job Portal – A Complete Recruitment System for Company or Job Board website: SQL injection WP Job Portal – A Complete Recruitment System for Company or Job Board website is affected by SQL injection. Exploitation requires an authenticated administrator account. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE4.9
Nov 18, 2024	CVE-2024-52389 WP Job Portal: Cross-site scripting WP Job Portal is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5
Sep 04, 2024	CVE-2024-7950 WP Job Portal – A Complete Recruitment System for Company or Job Board website: Filesystem traversal WP Job Portal – A Complete Recruitment System for Company or Job Board website is affected by filesystem traversal. The vulnerable path is reachable without authentication. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE9.8
Aug 18, 2024	CVE-2024-43266 WP Job Portal: A security weakness WP Job Portal is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.4
Jun 21, 2024	CVE-2024-35760 WP Job Portal: Cross-site scripting WP Job Portal is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9
Jun 21, 2024	CVE-2024-35759 WP Job Portal: Cross-site scripting WP Job Portal is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9
Jan 17, 2024	CVE-2022-41786 WP Job Portal – A Complete Job Board: A security weakness WP Job Portal – A Complete Job Board is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.4
Jan 05, 2024	CVE-2023-52184 WP Job Portal – A Complete Job Board: Cross-site request forgery WP Job Portal – A Complete Job Board is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3
Sep 25, 2023	CVE-2023-4490 WP Job Portal: SQL injection WP Job Portal is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE9.8
Jun 22, 2023	CVE-2023-28534 Wp Job Portal: Cross-site scripting Wp Job Portal is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers