CVE-2024-35760 in WP Job Portal Plugin
Summary
by MITRE • 06/21/2024
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpjobportal WP Job Portal wp-job-portal allows DOM-Based XSS.This issue affects WP Job Portal: from n/a through <= 2.1.3.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/02/2026
The CVE-2024-35760 vulnerability represents a critical cross-site scripting flaw within the wpjobportal WP Job Portal plugin, specifically exposing users to DOM-based XSS attacks. This vulnerability exists in versions ranging from the initial release through version 2.1.3, indicating a prolonged period during which the security flaw remained unaddressed. The issue stems from improper input neutralization during web page generation processes, creating an exploitable vector that allows attackers to inject malicious scripts into web pages viewed by other users. The DOM-based nature of this vulnerability means that the malicious payload executes within the document object model of the web page rather than being reflected in HTTP response headers, making detection and prevention more challenging for traditional security measures.
The technical implementation of this vulnerability occurs when user-supplied input is not properly sanitized or escaped before being rendered within the plugin's dynamic web pages. This flaw typically manifests when parameters passed through URL query strings or other client-side data sources are directly incorporated into JavaScript code or DOM manipulation functions without adequate validation or encoding. Attackers can craft malicious URLs containing script payloads that, when executed in a victim's browser context, can perform actions such as stealing session cookies, redirecting users to malicious sites, or executing unauthorized commands on behalf of the victim. The vulnerability specifically affects the plugin's web page generation functionality, where user input is processed and displayed without proper security controls to prevent script injection.
The operational impact of CVE-2024-35760 extends beyond simple script execution, potentially enabling attackers to compromise entire user sessions and gain unauthorized access to sensitive data within the WordPress environment. When exploited, this vulnerability allows threat actors to manipulate the DOM of affected web pages, potentially leading to credential theft, data exfiltration, or the installation of additional malicious software. The vulnerability affects all users who interact with the plugin's functionality, particularly those who view job listings, submit applications, or engage with other interactive elements within the WP Job Portal framework. Organizations running vulnerable versions face significant risks including potential data breaches, reputational damage, and compliance violations, especially in environments where sensitive job seeker information is processed.
Security mitigation strategies for CVE-2024-35760 require immediate action including updating to the latest version of the WP Job Portal plugin where the vulnerability has been addressed. System administrators should implement comprehensive input validation and output encoding mechanisms to prevent similar issues in other custom or third-party plugins. The remediation process should include thorough security auditing of all plugin components, particularly those handling user input and dynamic content generation. Organizations should also deploy web application firewalls and content security policies to add defensive layers against potential exploitation attempts. Additionally, implementing proper security monitoring and logging practices will help detect any attempted exploitation of this vulnerability. This issue aligns with CWE-79 which specifically addresses cross-site scripting vulnerabilities, and represents a clear violation of ATT&CK technique T1059.007 for script injection attacks, demonstrating the critical need for proper input sanitization and output encoding throughout web application development processes.