CVE-2025-12836 is a stored cross-site scripting vulnerability (CWE-79) in the VK Google Job Posting Manager WordPress plugin. It affects versions up to and including 1.2.23 due to improper neutralization of input in the Job Description field. Authenticated attackers with author-level privileges can inject arbitrary JavaScript that executes in the context of users viewing the injected pages. This vulnerability can lead to limited confidentiality and integrity impacts, such as session hijacking or content manipulation, but does not affect availability. The vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No patch or official fix has been disclosed by the vendor as of the published date.

Successful exploitation allows authenticated users with author-level or higher permissions to inject persistent malicious scripts into web pages viewed by other users. This can lead to partial confidentiality and integrity compromise, such as theft of session tokens or manipulation of displayed content. There is no impact on system availability. The vulnerability requires authentication and privileges, limiting the attack surface. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level permissions to trusted users only and consider disabling or removing the VK Google Job Posting Manager plugin if not essential. Monitor for updates from the vendor and apply any official patches promptly once released.