Extension WordPress
Vulnérabilités WP JobHunt
Cette page rassemble les failles publiées pour WP JobHunt, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de WP JobHunt
12 fiches
WP JobHunt <= 7.7 – Missing Authorization to Authenticated (Candidate+) Stored Cross-Site Scripting via 'status'
The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to unauthorized modification of data due to a missing capability check on the 'cs_update_application_status_callback' function in all versions up to, and including, 7.7. This makes…
*-7.7
Non indiqué
20/12/2025
WP JobHunt <= 7.7 – Authenticated (Candidate+) Insecure Direct Object Reference
The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.7 via the 'cs_update_application_status_callback' due to missing validation on a user controlled key.…
*-7.7
Non indiqué
20/12/2025
WP JobHunt <= 7.6 Authenticated (Custom+) Authorization Bypass
The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to authorization bypass in all versions up to, and including, 7.6. This is due to insufficient login restrictions on inactive and pending accounts. This makes…
*-7.6
7.7
09/10/2025
WP JobHunt <= 7.6 – Authenticated (Candidate+) Stored Cross-Site Scripting via ‘cs_job_title’
The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to Stored Cross-Site Scripting via the ‘cs_job_title’ parameter in all versions up to, and including, 7.6 due to insufficient input sanitization and output escaping. This…
*-7.6
7.7
09/10/2025
WP JobHunt <= 7.2 – Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Account Deletion
The WP JobHunt plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.2 via the cs_remove_profile_callback() function due to missing validation on a user controlled key. This makes it possible…
*-7.2
Non indiqué
21/07/2025
WP JobHunt <= 7.1 – Unauthenticated Insecure Direct Object Reference
The WP JobHunt plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.1 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to…
*-7.1
Non indiqué
16/05/2025
WP JobHunt <= 7.1 – Authentication Bypass to Candidate
The WP JobHunt plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.1. This is due to wp_ajax_google_api_login_callback function not properly verifying a user's identity prior to authenticating them. This makes it…
*-7.1
Non indiqué
13/03/2025
WP JobHunt <= 7.1 – Authentication Bypass
The WP JobHunt plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.1. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the cs_parse_request()…
*-7.1
Non indiqué
13/03/2025
WP JobHunt <= 7.1 – Unauthenticated Privilege Escalation via Password Reset/Account Takeover
The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.9. This is due to the plugin not properly validating a user's identity prior to updating their…
*-7.1
Non indiqué
13/03/2025
WP JobHunt <= 7.1 – Unauthenticated Privilege Escalation via Email Update/Account Takeover
The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 7.1. This is due to the plugin not properly validating a user's identity prior to updating their…
*-7.1
Non indiqué
13/03/2025
JobCareer | Job Board Responsive WordPress Theme < 2.4 – Unauthenticated Arbitrary Password Reset
The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() function through the admin-ajax.php file, which allows remote unauthenticated attackers to reset the password of a user's account.
[*, 2.4)
2.4
04/12/2018
JobCareer | Job Board Responsive WordPress Theme < 2.4 – User Enumeration
The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profile() function through the admin-ajax.php file, which allows remote unauthenticated attackers to enumerate information about users.
[*, 2.4)
2.4
04/12/2018
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.