Skip to content
Noroxi

JS Job Manager

js-jobs · plugin

Known security vulnerabilities for JS Job Manager. Find out in seconds which version runs on your site with WP Lens.

11 known vulnerabilities

2 critical · 6 exploitable without logging in · latest Sep 22, 2025

Closed on wordpress.org

Removed from the directory on Sep 4, 2026 · reason: no reason given. A closed component gets no more updates; installed copies keep running and their vulnerabilities stay open. Remove it or replace it with a maintained alternative.

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2025-32660unauthenticated≤ 2.0.2

    WordPress JS Job Manager plugin <= 2.0.2 - Arbitrary File Upload vulnerability

    Critical 9.8

  • CVE-2025-32626unauthenticated≤ 2.0.2

    WordPress JS Job Manager plugin <= 2.0.2 - SQL Injection vulnerability

    Critical 9.8

  • CVE-2023-31087unauthenticated · needs a click≤ 2.0.0

    WordPress JS Job Manager Plugin <=2.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

    High 8.8

  • CVE-2018-20974unauthenticated · needs a click

    The js-jobs plugin before 1.0.7 for WordPress has CSRF.

    High 8.8

  • CVE-2025-32146login required≤ 2.0.2

    WordPress JS Job Manager plugin <= 2.0.2 - Local File Inclusion vulnerability

    High 8.8

  • CVE-2025-32627unauthenticated≤ 2.0.2

    WordPress JS Job Manager plugin <= 2.0.2 - Local File Inclusion vulnerability

    High 8.1

  • CVE-2023-28689login required≤ 2.0.0

    WordPress JS Job Manager plugin <= 2.0.0 - Broken Access Control vulnerability

    Medium 6.5

  • CVE-2025-58234login required≤ 2.0.2

    WordPress JS Job Manager Plugin <= 2.0.2 - Cross Site Scripting (XSS) Vulnerability

    Medium 5.4

  • CVE-2025-31867login required≤ 2.0.2

    WordPress JS Job Manager Plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability

    Medium 5.4

  • CVE-2025-31868unauthenticated≤ 2.0.2

    WordPress JS Job Manager plugin <= 2.0.2 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2023-25963admin≤ 2.0.0

    WordPress JS Job Manager Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)

    Medium 4.8

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory