WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website has 44 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 44 are fixed as of October 2026. Their average CVSS score is 5.9, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 8 high. 2025 was the busiest year with 15 disclosures.
The most common weakness is Authorization Bypass Through User-Controlled Key, behind 12 of the records (27%). Other recurring categories include SQL Injection, Cross-Site Scripting.
Every one of the 44 issues recorded for WP Job Portal – AI-Powered Recruitment System for Company or Job Board website has a vendor fix available, so running the current release closes all known holes.
23 independent researchers contributed these findings, most of them (11) reported by thevietronin. WP Job Portal – AI-Powered Recruitment System for Company or Job Board website is installed on roughly 8,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-47438WP Job Portal <= 2.3.1 - Unauthenticated Local File Inclusion
Read the full analysisVulnerability Records

WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
Author
wpjobportal
WP Job Portal is a complete recruitment system for WordPress: a careers page for your own company, or a job board for many employers. Post jobs, receive applications, review resumes and hire from your WordPress dashboard. No coding needed. Hiring for your company? Publish your openings on a branded careers page, take applications and keep every candidate in one place. Running a job board? Employers register, post jobs and manage their applicants; job seekers build resumes and apply in a few clicks. Charge for listings when you are ready. You are live in minutes: the setup wizard prepares the site for a company or a job board, creates the pages and can add sample jobs to show it working. View demo | Documentation | Videos | Support Smarter hiring with AI AI writing: draft job and company descriptions, resume skills and cover letters in seconds (needs a ZyWrap account). Smart Search & Matching (premium): relevance-ranked job and resume search, suggested jobs for candidates, suggested resumes for employers and a match score for every application, run on your own server. Jobs that get found Google for Jobs: every job carries JobPosting structured data, so it can appear in Google’s job search. Search-engine-friendly job addresses and a jobs XML sitemap Share buttons, RSS feeds and a “tell a friend” email for every job Weekly job alert emails that bring candidates back For job seekers Search by keyword, category, job type, location and salary, and save searches to run again Build a resume once and apply in a few clicks, or use Quick Apply with a resume file Shortlist jobs and follow every application from a personal dashboard For employers Post, copy and manage jobs and company profiles from the front end Review applicants, read and print resumes A dashboard with their jobs, applications and statistics Easy to run and fit to your site Approve jobs, companies and resumes before they go live Custom fields for jobs, resumes, companies and registration, with conditional logic Gutenberg blocks, an Elementor widget, 30+ shortcodes and seven sidebar widgets Works with any theme, with color presets to match your design, and supports right-to-left languages Registration and login for employers and job seekers, protected by Google reCAPTCHA or Cloudflare Turnstile An email template for every notification, and control over who receives which Location data for 186 countries, in English or the local language Import companies, jobs, resumes and applications from WP Job Manager Activity log and a system status page Premium products Add what your site needs. Each product works with the free plugin on its own and installs from your WordPress dashboard. Compare plans. Pro: advanced resume builder, multiple resumes and cover letters, resume search, visitor applications, messaging, PDF and export, reports, instant job alerts and maps with radius search. Marketplace Suite: sell job packages, credits and subscriptions through Stripe, PayPal or WooCommerce, with paid featured jobs, companies and resumes. Recruit Suite: a hiring pipeline for teams, with stages, scorecards, shared notes, offers with approvals and e-signatures, and recruiting reports. Smart Search & Matching: AI job and resume search, suggestions and match scores. Translations WP Job Portal is available in Arabic, Chinese (China), Czech, Dutch, French, German, Greek, Hebrew, Indonesian, Italian, Japanese, Polish, Portuguese (Brazil), Romanian, Russian, Spanish and Turkish, and installs the one your site uses. Help translate on translate.wordpress.org. External services WP Job Portal runs on your own server. It connects to the services below only in the cases described. WP Job Portal translations (wpjobportal.com): when the site language is not English, the plugin downloads that language’s translation files and checks daily for updates. It sends nothing but the request for the files. To turn this off, add define( 'WPJOBPORTAL_TRANSLATIONS_AUTO', false ); to wp-config.php. Terms, Privacy policy. WP Job Portal licences and updates (wpjobportal.com): only when you enter a licence key or have a premium product installed. It sends the licence key, your site address and the installed product versions, to activate the licence and offer updates. Terms, Privacy policy. ZyWrap (api.zywrap.com): only when you turn on AI content generation and add your ZyWrap key. The text you ask it to write about is sent to ZyWrap. Terms, Privacy policy. Google Maps (maps.googleapis.com): only when you add a Google Maps API key. Map pages load Google’s map script in the visitor’s browser. Terms, Privacy policy. Google reCAPTCHA (google.com) or Cloudflare Turnstile (challenges.cloudflare.com): only when you turn one on for forms. The form page loads its script in the visitor’s browser. Google privacy policy, Cloudflare privacy policy.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C