WP Job Portal – AI-Powered Recruitment System for Company or Job Board website

WP Job Portal – AI-Powered Recruitment System for Company or Job Board website has 44 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 44 are fixed as of October 2026. Their average CVSS score is 5.9, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 8 high. 2025 was the busiest year with 15 disclosures.

The most common weakness is Authorization Bypass Through User-Controlled Key, behind 12 of the records (27%). Other recurring categories include SQL Injection, Cross-Site Scripting.

Every one of the 44 issues recorded for WP Job Portal – AI-Powered Recruitment System for Company or Job Board website has a vendor fix available, so running the current release closes all known holes.

23 independent researchers contributed these findings, most of them (11) reported by thevietronin. WP Job Portal – AI-Powered Recruitment System for Company or Job Board website is installed on roughly 8,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

01234567891021.08.2020Today17.03.20236.4WP Job Portal <= 2.0.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVSS 6.4 · 17.03.202305.05.20235.3WP Job Portal <= 2.0.1 - Missing Authorization to Settings Modification CVSS 5.3 · 05.05.20234.3WP Job Portal <= 2.0.1 - Cross-Site Request Forgery to Settings Modification CVSS 4.3 · 05.05.202330.08.20239.8WP Job Portal <= 2.0.5 - Unauthenticated SQL Injection CVSS 9.8 · 30.08.202329.12.20234.3WP Job Portal <= 2.0.6 - Cross-Site Request Forgery CVSS 4.3 · 29.12.202317.06.20244.4WP Job Portal <= 2.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 17.06.20244.4WP Job Portal <= 2.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 17.06.202412.08.20244.3WP Job Portal <= 2.1.8 - Authenticated (Subscriber+) Insecure Direct Object Reference CVSS 4.3 · 12.08.202403.09.20249.8WP Job Portal <= 2.1.6 - Missing Authorization to Unauthenticated Local File Inclusion, Arbitrary Settings Update, and User Creation CVSS 9.8 · 03.09.202411.11.20246.4WP Job Portal <= 2.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVSS 6.4 · 11.11.202413.12.20244.9WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via getFieldsForVisibleCombobox() CVSS 4.9 · 13.12.20244.9WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via wpjobportal_deactivate() CVSS 4.9 · 13.12.20244.8WP Job Portal <= 2.2.2 - Missing Authorization to Limited Privilege Escalation CVSS 4.8 · 13.12.20245.3WP Job Portal <= 2.2.2 - Missing Authorization to Unauthenticated Arbitrary Resume Download CVSS 5.3 · 13.12.20247.5WP Job Portal <= 2.2.1 - Unauthenticated SQL Injection CVSS 7.5 · 13.12.20244.9WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection CVSS 4.9 · 13.12.202402.01.20254.3WP Job Portal – A Complete Recruitment System for Company or Job Board website <= 2.2.4 - Authenticated (Subscriber+) Insecure Direct Object Reference CVSS 4.3 · 02.01.202506.01.20254.3WP Job Portal – A Complete Recruitment System for Company or Job Board website <= 2.2.5- Authenticated (Subscriber+) Insecure Direct Object Reference CVSS 4.3 · 06.01.202531.01.20255.3WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Arbitrary Resume Download CVSS 5.3 · 31.01.20254.3WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Job Deletion CVSS 4.3 · 31.01.20254.3WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Company Deletion CVSS 4.3 · 31.01.20255.3WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Company Logo Deletion CVSS 5.3 · 31.01.20255.3WP Job Portal <= 2.2.6 - Missing Authorization to Unauthenticated Arbitrary Email Sending CVSS 5.3 · 31.01.202521.02.20254.3WP Job Portal <= 2.2.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Photo Disconnection CVSS 4.3 · 21.02.202523.02.20258.8WP Job Portal <= 2.2.8 - Authenticated (Contributor+) Local File Inclusion CVSS 8.8 · 23.02.202508.05.20259.8WP Job Portal <= 2.3.1 - Unauthenticated Local File Inclusion CVSS 9.8 · 08.05.202519.05.20255.3WP Job Portal <= 2.3.2 - Unauthenticated Insecure Direct Object Reference CVSS 5.3 · 19.05.202524.05.20257.5WP Job Portal <= 2.3.2 - Unauthenticated Arbitrary File Download CVSS 7.5 · 24.05.202511.06.20257.5WP Job Portal <= 2.3.2 - Unauthenticated SQL Injection CVSS 7.5 · 11.06.202511.12.20256.5WP Job Portal <= 2.4.0 - Authenticated (Subscriber+) Arbitrary File Read CVSS 6.5 · 11.12.20254.4WP Job Portal <= 2.5.2 - Authenticated (Editor+) Stored Cross-Site Scripting via Job Description Field CVSS 4.4 · 11.12.202524.01.20264.3Job Portal <= 2.4.3 - Authenticated (Subscriber+) Insecure Direct Object Reference CVSS 4.3 · 24.01.202603.02.20265.3WP Job Portal <= 2.4.4 - Missing Authorization CVSS 5.3 · 03.02.202623.03.20267.5WP Job Portal <= 2.4.8 - Unauthenticated SQL Injection via 'radius' Parameter CVSS 7.5 · 23.03.202625.03.20268.8WP Job Portal <= 2.4.9 - Authenticated (Subscriber+) Arbitrary File Deletion via Resume Custom File Field CVSS 8.8 · 25.03.202623.05.20267.2WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.5.1 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 23.05.20267.5WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.5.1 - Unauthenticated SQL Injection CVSS 7.5 · 23.05.202602.06.20266.4WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.5.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVSS 6.4 · 02.06.202622.06.20264.3Job Portal <= 2.5.4 - Missing Authorization CVSS 4.3 · 22.06.20264.3Job Portal <= 2.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Email Disclosure CVSS 4.3 · 22.06.202625.06.20266.5Job Portal <= 2.5.4 - Authenticated (Subscriber+) SQL Injection CVSS 6.5 · 25.06.202626.06.20266.5WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.5.2 - Authenticated (Contributor+) SQL Injection CVSS 6.5 · 26.06.202606.08.20266.5WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.5.6 - Authenticated (Subscriber+) SQL Injection CVSS 6.5 · 06.08.202627.08.20264.3WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.5.9 - Authenticated (Subscriber+) Insecure Direct Object Reference CVSS 4.3 · 27.08.2026

Strategic Overview

Avg CVSSMedium
5.9/ 10
Patch Coverage100%
Open

0

Fixed

44

Get automatic notifications for all WP Job Portal – AI-Powered Recruitment System for Company or Job Board website vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2025-47438

WP Job Portal <= 2.3.1 - Unauthenticated Local File Inclusion

Read the full analysis

Vulnerability Records

44 records
2026-08-27 00:00CVE-2026-81299
4.3
Medium
Md Mehedi HasanYes
2026-08-06 00:00CVE-2026-65569
6.5
Medium
dzeuskingYes
2026-06-26 00:00CVE-2026-57653
6.5
Medium
hhhaiYes
2026-06-25 00:00CVE-2026-12395
6.5
Medium
Meher Sudhakar AbbireddiYes
2026-06-22 00:00CVE-2026-12396
4.3
Medium
Meher Sudhakar AbbireddiYes
2026-06-22 00:00CVE-2026-12397
4.3
Medium
Muni Nitish Kumar YaddalaYes
2026-06-02 00:00CVE-2026-48880
6.4
Medium
Jonathan DerschYes
2026-05-23 00:00CVE-2026-42685
7.2
High
hhhaiYes
2026-05-23 00:00CVE-2026-42684
7.5
High
hhhaiYes
2026-03-25 10:39CVE-2026-4758
8.8
High
darooYes
Showing 1–10 of 44 reports
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website banner
Latestv2.7.1

WP Job Portal – AI-Powered Recruitment System for Company or Job Board website

wpjobportal

Author

wpjobportal

4.3(32)
86/100
Last Updated
2026-10-27 (1d ago)
Active Installs
8,000+
Downloads
696,902
Requires WP
6.2+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2020-08-21 (6y ago)

WP Job Portal is a complete recruitment system for WordPress: a careers page for your own company, or a job board for many employers. Post jobs, receive applications, review resumes and hire from your WordPress dashboard. No coding needed. Hiring for your company? Publish your openings on a branded careers page, take applications and keep every candidate in one place. Running a job board? Employers register, post jobs and manage their applicants; job seekers build resumes and apply in a few clicks. Charge for listings when you are ready. You are live in minutes: the setup wizard prepares the site for a company or a job board, creates the pages and can add sample jobs to show it working. View demo | Documentation | Videos | Support Smarter hiring with AI AI writing: draft job and company descriptions, resume skills and cover letters in seconds (needs a ZyWrap account). Smart Search & Matching (premium): relevance-ranked job and resume search, suggested jobs for candidates, suggested resumes for employers and a match score for every application, run on your own server. Jobs that get found Google for Jobs: every job carries JobPosting structured data, so it can appear in Google’s job search. Search-engine-friendly job addresses and a jobs XML sitemap Share buttons, RSS feeds and a “tell a friend” email for every job Weekly job alert emails that bring candidates back For job seekers Search by keyword, category, job type, location and salary, and save searches to run again Build a resume once and apply in a few clicks, or use Quick Apply with a resume file Shortlist jobs and follow every application from a personal dashboard For employers Post, copy and manage jobs and company profiles from the front end Review applicants, read and print resumes A dashboard with their jobs, applications and statistics Easy to run and fit to your site Approve jobs, companies and resumes before they go live Custom fields for jobs, resumes, companies and registration, with conditional logic Gutenberg blocks, an Elementor widget, 30+ shortcodes and seven sidebar widgets Works with any theme, with color presets to match your design, and supports right-to-left languages Registration and login for employers and job seekers, protected by Google reCAPTCHA or Cloudflare Turnstile An email template for every notification, and control over who receives which Location data for 186 countries, in English or the local language Import companies, jobs, resumes and applications from WP Job Manager Activity log and a system status page Premium products Add what your site needs. Each product works with the free plugin on its own and installs from your WordPress dashboard. Compare plans. Pro: advanced resume builder, multiple resumes and cover letters, resume search, visitor applications, messaging, PDF and export, reports, instant job alerts and maps with radius search. Marketplace Suite: sell job packages, credits and subscriptions through Stripe, PayPal or WooCommerce, with paid featured jobs, companies and resumes. Recruit Suite: a hiring pipeline for teams, with stages, scorecards, shared notes, offers with approvals and e-signatures, and recruiting reports. Smart Search & Matching: AI job and resume search, suggestions and match scores. Translations WP Job Portal is available in Arabic, Chinese (China), Czech, Dutch, French, German, Greek, Hebrew, Indonesian, Italian, Japanese, Polish, Portuguese (Brazil), Romanian, Russian, Spanish and Turkish, and installs the one your site uses. Help translate on translate.wordpress.org. External services WP Job Portal runs on your own server. It connects to the services below only in the cases described. WP Job Portal translations (wpjobportal.com): when the site language is not English, the plugin downloads that language’s translation files and checks daily for updates. It sends nothing but the request for the files. To turn this off, add define( 'WPJOBPORTAL_TRANSLATIONS_AUTO', false ); to wp-config.php. Terms, Privacy policy. WP Job Portal licences and updates (wpjobportal.com): only when you enter a licence key or have a premium product installed. It sends the licence key, your site address and the installed product versions, to activate the licence and offer updates. Terms, Privacy policy. ZyWrap (api.zywrap.com): only when you turn on AI content generation and add your ZyWrap key. The text you ask it to write about is sent to ZyWrap. Terms, Privacy policy. Google Maps (maps.googleapis.com): only when you add a Google Maps API key. Map pages load Google’s map script in the visitor’s browser. Terms, Privacy policy. Google reCAPTCHA (google.com) or Cloudflare Turnstile (challenges.cloudflare.com): only when you turn one on for forms. The form page loads its script in the visitor’s browser. Google privacy policy, Cloudflare privacy policy.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C