WordPress plugin
Job Postings security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High1
- Medium12
- Low0
All Job Postings vulnerabilities
- High8.1Authenticated (Contributor+) Arbitrary File Deletion
≤2.8.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'position_button' Parameter
≤2.8.1Update to 2.8.2
- Medium5.3Missing Authorization
≤2.8Update to 2.8.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.8.3No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.7.14Update to 2.7.15
- Medium6.5Authenticated (Subscriber+) Arbitrary File Read
≤2.7.11Update to 2.7.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.7.10Update to 2.7.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.7.7Update to 2.7.8
- Medium6.1Reflected Cross-Site Scripting via job-search
≤2.7.5Update to 2.7.6
- Medium6.1Reflected Cross-Site Scripting
≤2.7.5Update to 2.7.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.7.3Update to 2.7.4
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤2.5.10.2Update to 2.5.11
- Medium6.4Authenticated (Author+) Cross Site Scripting
≤2.5.10.2Update to 2.5.11
Job Postings: common questions
Does Job Postings have known vulnerabilities?
Yes. VulnCrest Radar lists 13 known vulnerabilities in Job Postings: 1 high, 12 medium. At least one is not fixed in the latest version.
How do I check which version of Job Postings I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Job Postings vulnerability?
CVE-2026-39752, published Oct 5, 2026: Job Postings <= 2.8.2 - Authenticated (Contributor+) Arbitrary File Deletion. Severity: High (CVSS 8.1).
Is any Job Postings vulnerability listed in CISA KEV?
No. None of the known Job Postings vulnerabilities is currently listed in the CISA KEV catalog.