CVE-2025-13383: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in bestweblayout Job Board by BestWebSoft
The Job Board by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.1. This is due to the plugin storing the entire unsanitized `$_GET` superglobal array directly into the database via `update_user_meta()` when users save search results, and later outputting this data without proper escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses the saved search or views their profile, granted they can trick the user into performing the search and saving the results.
AI Analysis
Technical Summary
CVE-2025-13383 is a stored cross-site scripting vulnerability in the Job Board by BestWebSoft WordPress plugin (up to version 1.2.1). The issue arises from the plugin saving the entire unsanitized $_GET array into the database via update_user_meta() when users save search results. Later, this data is output without proper escaping, allowing injection and execution of arbitrary scripts in the context of users viewing saved searches or profiles. The vulnerability requires user interaction but no privileges or authentication for the attacker.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of affected users, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited to confidentiality and integrity (partial), with no direct availability impact. The vulnerability affects all users who access saved searches or profiles containing malicious input.
Mitigation Recommendations
No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should avoid saving search results or instruct users not to interact with untrusted saved searches or profiles. Implementing web application firewall (WAF) rules to detect and block malicious input may provide temporary mitigation.
CVE-2025-13383: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in bestweblayout Job Board by BestWebSoft
Description
The Job Board by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.1. This is due to the plugin storing the entire unsanitized `$_GET` superglobal array directly into the database via `update_user_meta()` when users save search results, and later outputting this data without proper escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses the saved search or views their profile, granted they can trick the user into performing the search and saving the results.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-13383 is a stored cross-site scripting vulnerability in the Job Board by BestWebSoft WordPress plugin (up to version 1.2.1). The issue arises from the plugin saving the entire unsanitized $_GET array into the database via update_user_meta() when users save search results. Later, this data is output without proper escaping, allowing injection and execution of arbitrary scripts in the context of users viewing saved searches or profiles. The vulnerability requires user interaction but no privileges or authentication for the attacker.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of affected users, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited to confidentiality and integrity (partial), with no direct availability impact. The vulnerability affects all users who access saved searches or profiles containing malicious input.
Mitigation Recommendations
No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should avoid saving search results or instruct users not to interact with untrusted saved searches or profiles. Implementing web application firewall (WAF) rules to detect and block malicious input may provide temporary mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-11-18T20:43:02.420Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 69255e28292ce6fc00be0610
Added to database: 11/25/2025, 7:43:36 AM
Last enriched: 4/9/2026, 9:05:14 PM
Last updated: 5/10/2026, 2:06:05 PM
Views: 64
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.