CVE-2026-108366 in Easy Jobs Plugin
Summary
by MITRE • 10/28/2026
The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the 'icon' attribute of the easyjobs/job-list Gutenberg block in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified within the easy.jobs plugin for WordPress represents a significant security risk due to its potential for stored cross-site scripting attacks. This specific flaw is located in the icon attribute of the easyjobs/job-list Gutenberg block and affects all versions up through 2.8.2. The root cause lies in insufficient input sanitization and output escaping mechanisms when handling user-supplied attributes. Because the vulnerability allows for the injection of arbitrary web scripts, it poses a direct threat to the integrity and confidentiality of data processed by the application. Attackers with contributor-level access or higher can exploit this weakness to embed malicious code into job listings that will execute in the browsers of any users who view these pages.
From a technical perspective, the lack of proper sanitization means that user input is not adequately filtered before being stored in the database. When this data is subsequently rendered on the frontend without appropriate escaping, the browser interprets the injected scripts as legitimate code. This behavior aligns with CWE-79, which classifies improper neutralization of input during web page generation known as cross-site scripting. The persistence of the malicious payload distinguishes this from reflected XSS attacks, making it a stored vulnerability that can affect multiple victims over an extended period without further interaction from the attacker beyond the initial injection.
The operational impact of this vulnerability is substantial given its authenticated nature and the specific privilege level required to exploit it. Contributors are typically users with limited permissions who may still have access to create or edit content such as job listings. By leveraging these existing privileges, an attacker can persistently inject malicious scripts into public-facing pages. When other users, including potential candidates or administrators, visit these compromised pages, the injected code executes in their context. This can lead to session hijacking, where attackers steal authentication cookies to impersonate legitimate users, credential theft through phishing forms embedded within the script, or defacement of the website content. In severe cases, if higher-privileged accounts are targeted, it could facilitate further compromise of the underlying WordPress installation and associated server resources.
This vulnerability maps directly to several entries in the MITRE ATT&CK framework for enterprise security. It corresponds to T1059.007, which covers JavaScript as a client-side execution mechanism within the Execution tactic. Furthermore, because it involves injecting content into web pages that are then viewed by others, it aligns with T1189 Drive-by Compromise under the Initial Access or Impact tactics depending on the payload's intent. The persistence of the attack vector also relates to techniques used in long-term access maintenance, emphasizing the need for robust input validation and output encoding strategies across all user-facing components of web applications.
To mitigate this vulnerability, immediate action is required by updating the easy.jobs plugin to a version newer than 2.8.2 where these issues have been addressed. Developers should implement strict allow-listing for allowed characters in icon attributes rather than relying on blocklist approaches which may miss novel attack vectors. Additionally, enforcing Content Security Policy headers can help mitigate the impact of any successful XSS attempts by restricting the sources from which scripts are loaded and executed. Regular security audits focusing on input sanitization and output escaping practices across all Gutenberg blocks within WordPress plugins are essential to prevent similar vulnerabilities in future releases or other software components.