What’s Vulnerable › Vulnerabilities

CVE-2022-1170: JobMonster < 4.5.2.9 - Unauthenticated Reflected Cross-Site Scripting

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-04-04 · updated 2026-06-17
• Weakness: CWE-79

Description

In the Noo JobMonster WordPress theme before 4.5.2.9 JobMonster there is a XSS vulnerability as the input for the search form is provided through unsanitized GET requests.

Affected products

• NooTheme Jobmonster: before 4.5.2.9 — fixed in 4.5.2.9

How to fix

Upgrade to a fixed version: NooTheme Jobmonster 4.5.2.9. Check the vendor advisory for mitigations.

References

• https://themeforest.net/item/jobmonster-job-board-wordpress-theme/10965446
• https://wpscan.com/vulnerability/2ecb18e6-b575-4a20-bd31-94d24f1d1efc
• https://themeforest.net/item/jobmonster-job-board-wordpress-theme/10965446
• https://wpscan.com/vulnerability/2ecb18e6-b575-4a20-bd31-94d24f1d1efc

Get alerted when CVE-2022-1170 or the next vulnerability affects your stack