WP Job Portal – A Complete Recruitment System for Company or Job Board website

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   WP Job Portal – A Complete Recruitment System for Company or Job Board website

Information

Software Type Plugin
Software Slug wp-job-portal (view on wordpress.org)
Software Status Active
Software Author wpjobportal
Software Website wpjobportal.com
Software Downloads 241,225
Software Active Installs 6,000
Software Record Last Updated December 18, 2024

16 Vulnerabilities

Submit a Vulnerability
WP Job Portal <= 2.1.6 - Missing Authorization to Unauthenticated Local File Inclusion, Arbitrary Settings Update, and User Creation
9.8
CVE-2024-7950
Sep 3, 2024
Researcher: Connor Billings
WP Job Portal <= 2.0.5 - Unauthenticated SQL Injection
9.8
CVE-2023-4490
Aug 30, 2023
Researcher: Pablo Sanchez
WP Job Portal <= 2.2.1 - Unauthenticated SQL Injection
7.5
CVE-2024-11711
Dec 13, 2024
Researcher: thevietronin
WP Job Portal <= 2.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2024-52389
Nov 11, 2024
Researcher: casol
WP Job Portal <= 2.0.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2023-28534
Mar 17, 2023
Researcher: Fariq Fadillah Gusti Insani (fariqfgi)
WP Job Portal <= 2.2.2 - Missing Authorization to Unauthenticated Arbitrary Resume Download
5.3
CVE-2024-11712
Dec 13, 2024
Researcher: thevietronin
WP Job Portal <= 2.0.1 - Missing Authorization to Settings Modification
5.3
CVE-2022-41786
May 5, 2023
Researcher: István Márton
WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via wpjobportal_deactivate()
4.9
CVE-2024-11713
Dec 13, 2024
Researchers: Nhien Pham (nhienit), thevietronin
WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection
4.9
CVE-2024-11710
Dec 13, 2024
Researcher: thevietronin
WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via getFieldsForVisibleCombobox()
4.9
CVE-2024-11714
Dec 13, 2024
Researcher: thevietronin
WP Job Portal <= 2.2.2 - Missing Authorization to Limited Privilege Escalation
4.8
CVE-2024-11715
Dec 13, 2024
Researcher: thevietronin
WP Job Portal <= 2.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2024-35759
Jun 17, 2024
Researcher: LuxF0z
WP Job Portal <= 2.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2024-35760
Jun 17, 2024
Researcher: LuxF0z
WP Job Portal <= 2.1.8 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVE-2024-43266
Aug 12, 2024
Researcher: LuxF0z
WP Job Portal <= 2.0.6 - Cross-Site Request Forgery
4.3
CVE-2023-52184
Dec 29, 2023
Researcher: Nguyen Xuan Chien
WP Job Portal <= 2.0.1 - Cross-Site Request Forgery to Settings Modification
4.3
CVE-2022-41786
May 5, 2023
Researcher: István Márton
Title Status CVE ID CVSS Researchers Date
WP Job Portal <= 2.1.6 - Missing Authorization to Unauthenticated Local File Inclusion, Arbitrary Settings Update, and User Creation Patched CVE-2024-7950 9.8 Connor Billings September 3, 2024
WP Job Portal <= 2.0.5 - Unauthenticated SQL Injection Patched CVE-2023-4490 9.8 Pablo Sanchez August 30, 2023
WP Job Portal <= 2.2.1 - Unauthenticated SQL Injection Patched CVE-2024-11711 7.5 thevietronin December 13, 2024
WP Job Portal <= 2.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting Patched CVE-2024-52389 6.4 casol November 11, 2024
WP Job Portal <= 2.0.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting Patched CVE-2023-28534 6.4 Fariq Fadillah Gusti Insani (fariqfgi) March 17, 2023
WP Job Portal <= 2.2.2 - Missing Authorization to Unauthenticated Arbitrary Resume Download Patched CVE-2024-11712 5.3 thevietronin December 13, 2024
WP Job Portal <= 2.0.1 - Missing Authorization to Settings Modification Patched CVE-2022-41786 5.3 István Márton May 5, 2023
WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via wpjobportal_deactivate() Patched CVE-2024-11713 4.9 Nhien Pham (nhienit), thevietronin December 13, 2024
WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection Patched CVE-2024-11710 4.9 thevietronin December 13, 2024
WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via getFieldsForVisibleCombobox() Patched CVE-2024-11714 4.9 thevietronin December 13, 2024
WP Job Portal <= 2.2.2 - Missing Authorization to Limited Privilege Escalation Patched CVE-2024-11715 4.8 thevietronin December 13, 2024
WP Job Portal <= 2.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2024-35759 4.4 LuxF0z June 17, 2024
WP Job Portal <= 2.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2024-35760 4.4 LuxF0z June 17, 2024
WP Job Portal <= 2.1.8 - Authenticated (Subscriber+) Insecure Direct Object Reference Patched CVE-2024-43266 4.3 LuxF0z August 12, 2024
WP Job Portal <= 2.0.6 - Cross-Site Request Forgery Patched CVE-2023-52184 4.3 Nguyen Xuan Chien December 29, 2023
WP Job Portal <= 2.0.1 - Cross-Site Request Forgery to Settings Modification Patched CVE-2022-41786 4.3 István Márton May 5, 2023

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation