CVE-2025-24781 describes a reflected cross-site scripting vulnerability in the WPJobBoard plugin for WordPress, developed by NotFound. The issue stems from improper input neutralization during web page generation, which allows attackers to inject malicious scripts that are reflected back to users. This vulnerability affects all versions up to 5.10.1. The CVSS 3.1 score of 7.1 reflects a high-severity risk with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability. There is no vendor-provided patch or official remediation information at this time, and the plugin is not a cloud service, so remediation depends on applying updates when released.

Successful exploitation of this reflected XSS vulnerability can lead to execution of arbitrary scripts in the context of the victim's browser, potentially resulting in theft of user credentials, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability of user data. The CVSS vector indicates that exploitation requires user interaction but no privileges or authentication. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying temporary mitigations such as disabling or restricting access to the vulnerable plugin if feasible. Monitor official NotFound WPJobBoard advisories for updates and apply patches promptly once available. No vendor advisory or patch links are currently provided.