This vulnerability involves improper neutralization of input during web page generation (CWE-79) in the sebet Go Fetch Jobs plugin for WP Job Manager. Specifically, the url parameter is not properly sanitized or escaped, enabling reflected cross-site scripting attacks. An unauthenticated attacker can craft a malicious URL that, when visited by a user, executes arbitrary scripts in the context of the victim's browser session. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and limited confidentiality and integrity impacts. The vulnerability affects version 0 of the plugin, with no patch or official remediation level currently documented.

Successful exploitation can lead to execution of arbitrary scripts in the victim's browser, potentially allowing theft of sensitive information or manipulation of web content within the affected site context. The impact is limited to confidentiality and integrity, with no availability impact reported. Since the attack requires user interaction and is reflected, the risk is medium severity as per the CVSS score of 6.1. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted links involving the affected plugin. No vendor-provided mitigation or temporary fix is currently documented.