JobCareer <= 3.4 - Multiple Cross-Site Scripting

The JobCareer | Job Board Responsive plugin for WordPress is vulnerable to both authenticated Stored and unauthenticated Reflected Cross-Site Scripting in versions up to, and including, 3.4 due to insufficient input sanitization and output escaping. The Reflected XSS is vulnerable to the following parameters: 'job_title', 'specialisms', and 'location' while the Stored XSS is vulnerable to the (Complete Address) text field. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.