PCRecruiter Extensions

PCRecruiter Extensions has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for PCRecruiter Extensions has a vendor fix available, so running the current release closes it.

All of these findings were reported by Muhammad Yudha - DJ. PCRecruiter Extensions is installed on roughly 300 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all PCRecruiter Extensions vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2024-11776

PCRecruiter Extensions <= 1.4.22 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
PCRecruiter Extensions banner
Latestv2.2.4

PCRecruiter Extensions

mstdev

Author

mstdev

0.0(0)
0/100
Last Updated
2026-09-09 (4d ago)
Active Installs
300+
Downloads
15,273
Requires WP
6.5+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2015-06-03 (11y ago)

PCRecruiter Extensions provides two primary integration methods. The setup is typically done with the direct involvement of a PCR consultant; it is advised that you contact support@mainsequence.net before proceeding. 1. Full WordPress Job Sync Sync active jobs from PCRecruiter into WordPress as native custom post types (job). Includes keyword and distance search, Google-ready job data (JobPosting), social sharing, automatic handling of filled jobs, instant search and filtering with a sidebar, and full control over styling using native WordPress tools. Additional Features: * Optional interactive job map (no API key required) — pins follow the visitor’s search filters * Sidebar with checkbox filters that let visitors narrow the results * Instant search, filtering, sorting, and paging (no page reloads) * Collapsible filter sections, type-to-filter, result-count badges, and removable filter “pills” * Sidebar on the left or right, depending on your template * Works with the WordPress Site Editor (block bindings, WordPress 6.5+) * Search-engine-friendly URLs and optional custom job titles * Built-in caching for faster pages * Internal-only job boards for private listings * Optional removal of inline styles so jobs match your site’s design * Accessible pagination * Works with older PCRecruiter setups 2. Simple iFrame Embed Embed the hosted PCRecruiter job board using a simple shortcode. Ideal for quick and simple installs or sites that prefer PCR-rendered pages, or sites where SEO and link friendliness are of less importance. Also: PCRecruiter job XML/JSON feed downloading for integrations or imports. Full documentation: https://learning.pcrecruiter.net/site/wordpress Support: support@mainsequence.net Quick Start Iframe Job Board: No plugin settings are required for iframe installations! Just insert the shortcode into your jobs page: [PCRecruiter link=”yourdatabase.yourprofile”] Contact your support representative for your shortcode. Full WordPress Job Sync: 1. Create a page and add: [PCRecruiter link=”jobmanager”] 2. Go to Settings → PCRecruiter Extensions → Job Board Sync. 3. Generate a Sync Token and enter it into the PCR “WordPress Sync Settings” panel. Features Secure, token-based syncing of your live jobs Jobs stored as normal WordPress posts Keyword and distance (radius) search A [pcr_search_form] shortcode that puts a search box on any page (homepage, landing page) and opens the results on your job board Optional interactive job map with clustered pins that follow the visitor’s search filters (OpenStreetMap — no API key or billing account needed) Instant search and filtering, with a sidebar, removable filter “pills,” and collapsible sections Layout controlled from your PCR search template (sidebar position, collapsible sections, type-to-filter, count badges, and list limits) Google-ready job listings (JobPosting structured data) Internal-only job boards for private listings Social sharing buttons Accessible pagination Choose to delete filled jobs or keep them visible with a “Filled” badge Customizable job titles for browser tabs and search results Optional removal of inline styles Automatically redirects old job links to the new, cleaner URLs Avoids duplicate job data when Yoast SEO is active Works with the WordPress Site Editor for dynamic templates Optional XML/JSON job feeds for other integrations Automatic, scheduled feed updates Clean uninstall, with options to keep or remove your data Built following WordPress security best practices Example Shortcodes Iframe Job Board: [PCRecruiter link=”my%20data.mycompany”] Full Sync Job Board: [PCRecruiter link=”jobmanager”] Optional filtering: [PCRecruiter link=”jobmanager” jobcategory=”Engineering”] Internal Job Board: [PCRecruiter link=”internaljobmanager”] Search box on another page (homepage, landing page) that sends visitors to your job board: [pcr_search_form] [pcr_search_form fields=”Radius”] [pcr_search_form fields=”Keyword,Radius” radius=”500&#8243; button=”Find Jobs”] The fields attribute takes your PCRecruiter search fields, in the order you want them. Use plain names (Radius, Keyword, City_State, Job_Type, Salary), friendly ones (location, keyword, jobtype, pay), or a custom field as Details.Profession. Labels and dropdown choices come from your job board configuration, so they match. Results always open on your configured Job Board Page; add action=”/jobs” to send them elsewhere. Use one instance per page, and not on the job board page itself — the job board’s own search form already includes these fields, and two copies conflict. Job board with the map forced on (or off) regardless of the global setting: [PCRecruiter link=”jobmanager” map=”on”] [PCRecruiter link=”jobmanager” map=”off”] External Services This plugin connects to PCRecruiter (Main Sequence Technology) and, when the Job Map is enabled, to OpenStreetMap. Nothing is sent anywhere else. PCRecruiter job board and sync — www2.pcrecruiter.net, host.pcrecruiter.net. The core integration: jobs are pushed from your PCRecruiter database to your site, apply/iframe pages, styling and tracking scripts load from PCRecruiter, and details a visitor submits when applying go to your PCRecruiter database. Terms and privacy: https://www.mainsequence.net/privacy-policy/ PCRecruiter geolocation lookup — maps.pcrecruiter.net. Two kinds of request. Your server sends a job’s city/state/zip (no personal data) to find its coordinates for the Job Map, once per location. Separately, when a visitor types in the distance/radius location box — on the job board, or on any page carrying the [pcr_search_form] shortcode — their browser sends what they typed directly to this service to suggest locations, which (as with any web request) also transmits their IP address. Nothing else about the visitor is sent. Terms and privacy: https://www.mainsequence.net/privacy-policy/ OpenStreetMap tiles — tile.openstreetmap.org. Only when the Job Map is enabled: visitors’ browsers load map images from the OpenStreetMap Foundation’s public tile server, sending their IP address and the map area viewed, as any image request does. Terms: https://operations.osmfoundation.org/policies/tiles/ — Privacy: https://osmfoundation.org/wiki/Privacy_Policy. Busy sites should mind OSM’s fair-use policy; the pcrecruiter_map_tile_url filter switches to another tile provider. The map is drawn by Leaflet (BSD-2-Clause) with Leaflet.markercluster (MIT), both bundled with the plugin — no CDN calls.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C