This vulnerability (CVE-2026-48880) is classified as CWE-79, indicating improper neutralization of input during web page generation, resulting in a cross-site scripting (XSS) flaw in the WP Job Portal plugin by Ahmad. It affects versions up to and including 2.5.2. The vulnerability allows a subscriber-level user to inject malicious scripts that could be executed in the context of other users, potentially impacting confidentiality, integrity, and availability. The CVSS v3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, requiring privileges at the subscriber level, and user interaction. No known exploits in the wild or official patches have been reported as of the publication date.

Successful exploitation of this vulnerability could allow an attacker with subscriber privileges to execute arbitrary scripts in the context of other users, potentially leading to limited disclosure of information, modification of data, or disruption of service. The CVSS vector indicates partial impact on confidentiality, integrity, and availability. However, exploitation requires user interaction and subscriber-level privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting subscriber privileges and educating users about the risks of interacting with untrusted content. Monitor for vendor updates regarding patches or official mitigations.