CWE Code: 79
Vulnerability Type: privilege_escalation
CVSS Score: 4.3
CWE Name:  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary: multiple client-side cross site scripting vulnerabilities have been discovered in the wpjobboard v4.5.1 web-application for wordpress. the vulnerabilities are located in the `query` and `id` parameters of the `wpjb-email`, `wpjb-job`, `wpjb-application`, and `wpjb-membership` modules. remote attackers are able to inject malicious script code to hijack admin session credentials via the backend, or to manipulate the backend on client-side performed requests. the attack vector is non-persistent and the request method to inject is get. the attacker does not need a privileged user account to perform a successful exploitation.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): NONE/PARTIAL/NONE
Published Date: 2017-10-16
Last Modified Date: 2017-11-06