Job Board Manager Vulnerabilities

The Job Board Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.61 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pag...

CVSS:

6.4

Affected:

up to 2.1.61

Fix:

No patched version reported

Disclosed:

Sep 26, 2025

CVE-2025-60162 on NVD →

The The Job Board Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.1.61. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attack...

CVSS:

5.4

Affected:

up to 2.1.61

Fix:

No patched version reported

Disclosed:

Sep 5, 2025

CVE-2025-58827 on NVD →

[en] Improper Control of Generation of Code ('Code Injection') vulnerability in PickPlugins Job Board Manager allows Code Injection. This issue affects Job Board Manager: from n/a through 2.1.61.

Affected:

up to 2.1.61

Fix:

No patched version reported

Disclosed:

Sep 5, 2025

CVE-2025-58827 on NVD →

[en] Missing Authorization vulnerability in PickPlugins Job Board Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Job Board Manager: from n/a through 2.1.60.

Affected:

up to 2.1.61

Fixed in:

2.1.61

Disclosed:

Jun 6, 2025

CVE-2025-49324 on NVD →

The Job Board Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.1.60. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 2.1.60

Fixed in:

2.1.61

Disclosed:

Jun 5, 2025

CVE-2025-49324 on NVD →

[en] Deserialization of Untrusted Data vulnerability in PickPlugins Job Board Manager allows Object Injection. This issue affects Job Board Manager: from n/a through 2.1.60.

Affected:

up to 2.1.60

Fix:

No patched version reported

Disclosed:

Apr 11, 2025

CVE-2025-32144 on NVD →

The Job Board Manager plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.1.60 via deserialization of untrusted input. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vuln...

CVSS:

8.8

Affected:

up to 2.1.60

Fix:

No patched version reported

Disclosed:

Apr 9, 2025

CVE-2025-32144 on NVD →

The Job Board Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.1.60. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 2.1.60

Fix:

No patched version reported

Disclosed:

Apr 1, 2025

CVE-2025-31862 on NVD →

[en] Missing Authorization vulnerability in PickPlugins Job Board Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Job Board Manager: from n/a through 2.1.60.

Affected:

up to 2.1.60

Fix:

No patched version reported

Disclosed:

Apr 1, 2025

CVE-2025-31862 on NVD →

The Job Board Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.1.60 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfu...

CVSS:

6.1

Affected:

up to 2.1.60

Fix:

No patched version reported

Disclosed:

Feb 3, 2025

CVE-2025-22679 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Job Board Manager allows Reflected XSS. This issue affects Job Board Manager: from n/a through 2.1.60.

Affected:

up to 2.1.60

Fix:

No patched version reported

Disclosed:

Feb 3, 2025

CVE-2025-22679 on NVD →

The Job Board Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.59. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they ca...

CVSS:

4.3

Affected:

up to 2.1.59

Fixed in:

2.1.60

Disclosed:

Jan 24, 2025

CVE-2025-24622 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in PickPlugins Job Board Manager allows Cross Site Request Forgery. This issue affects Job Board Manager: from n/a through 2.1.59.

Affected:

up to 2.1.60

Fixed in:

2.1.60

Disclosed:

Jan 24, 2025

CVE-2025-24622 on NVD →

[en] Missing Authorization vulnerability in PickPlugins Job Board Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Job Board Manager: from n/a through 2.1.60.

Affected:

up to 2.1.60

Fix:

No patched version reported

Disclosed:

Dec 16, 2024

CVE-2024-55993 on NVD →

The Job Board Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.1.60. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 2.1.60

Fix:

No patched version reported

Disclosed:

Dec 14, 2024

CVE-2024-55993 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PickPlugins Job Board Manager allows Stored XSS.This issue affects Job Board Manager: from n/a through 2.1.57.

Affected:

up to 2.1.59

Fixed in:

2.1.59

Disclosed:

Jul 20, 2024

CVE-2024-38722 on NVD →

The Job Board Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.58 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in page...

CVSS:

6.4

Affected:

up to 2.1.58

Fixed in:

2.1.59

Disclosed:

Jul 11, 2024

CVE-2024-38722 on NVD →

Affected:

up to 2.1.61

Fix:

No patched version reported

CVE-2025-60162 on NVD →