The WP Job Portal plugin for WordPress, versions up to and including 2.1.3, contains a DOM-based cross-site scripting vulnerability caused by improper neutralization of input during web page generation. This vulnerability allows an attacker with high privileges to execute malicious scripts in the context of another user, potentially affecting confidentiality, integrity, and availability. The CVSS 3.1 base score is 5.9, reflecting medium severity with network attack vector, low attack complexity, required privileges, and user interaction.

Successful exploitation can lead to partial compromise of confidentiality, integrity, and availability within the affected application context. Because the vulnerability is DOM-based XSS, it can be used to execute arbitrary scripts in the victim's browser, potentially leading to session hijacking or other client-side impacts. However, exploitation requires high privileges and user interaction, limiting the scope of impact.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the WP Job Portal vendor advisories for updates and apply any forthcoming patches promptly. Until a fix is released, restrict high-privilege user input and avoid interacting with untrusted content in the plugin interface to reduce risk.