PCRecruiter Extensions Security & Risk Analysis

wordpress.org/plugins/pcrecruiter-extensions

Integrates your WordPress site with PCRecruiter (PCR) to embed job boards or sync live job postings as native WordPress content.

300 active installs v2.0.11 PHP 7.4+ WP 5.6+ Updated Feb 12, 2026
applicant-trackingjob-boardjob-postingrecruitingstaffing
99
A · Safe
CVEs total1
Unpatched0
Last CVEDec 19, 2024
Safety Verdict

Is PCRecruiter Extensions Safe to Use in 2026?

Generally Safe

Score 99/100

PCRecruiter Extensions has a strong security track record. Known vulnerabilities have been patched promptly.

1 known CVELast CVE: Dec 19, 2024Updated 1mo ago
Risk Assessment

The 'pcrecruiter-extensions' v2.0.11 plugin exhibits a generally good security posture, with a strong emphasis on secure coding practices such as a high percentage of prepared SQL statements and properly escaped output. The plugin also demonstrates robust use of nonces and capability checks across its identified entry points, which is commendable. However, the taint analysis reveals a significant concern with four flows identified as having unsanitized paths, three of which are rated as high severity. This indicates a potential for attackers to inject malicious data into these flows, which could lead to unintended consequences if not properly handled downstream. While there's a history of one medium-severity CVE related to Cross-Site Scripting, the fact that it's currently unpatched is a critical oversight. The plugin's strengths lie in its diligent use of security features like prepared statements and output escaping, but the identified unsanitized paths and the unpatched CVE represent clear weaknesses that require immediate attention to mitigate potential risks.

Key Concerns

  • High severity unsanitized taint flows
  • Unpatched medium severity CVE
  • Unsanitized paths in taint flows
Vulnerabilities
1

PCRecruiter Extensions Security Vulnerabilities

CVEs by Year

1 CVE in 2024
2024
Patched Has unpatched

Severity Breakdown

Medium
1

1 total CVE

CVE-2024-11776medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

PCRecruiter Extensions <= 1.4.22 - Authenticated (Contributor+) Stored Cross-Site Scripting

Dec 19, 2024 Patched in 1.4.23 (2d)
Code Analysis
Analyzed Mar 16, 2026

PCRecruiter Extensions Code Analysis

Dangerous Functions
0
Raw SQL Queries
5
13 prepared
Unescaped Output
14
298 escaped
Nonce Checks
5
Capability Checks
5
File Operations
10
External Requests
1
Bundled Libraries
0

SQL Query Safety

72% prepared18 total queries

Output Escaping

96% escaped312 total outputs
Data Flows
4 unsanitized

Data Flow Analysis

5 flows4 with unsanitized paths
sanitize (PCRecruiter-Extensions.php:1568)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface

PCRecruiter Extensions Attack Surface

Entry Points6
Unprotected0

AJAX Handlers 4

authwp_ajax_pcr_deactivation_cleanupincludes\class-deactivation-handler.php:19
authwp_ajax_pcr_validate_schemaincludes\class-schema-mapper.php:37
authwp_ajax_pcr_preview_schemaincludes\class-schema-mapper.php:38
authwp_ajax_pcr_dismiss_schema_noticePCRecruiter-Extensions.php:284

REST API Routes 1

GET/wp-json/pcrecruiter/v1/job-fieldsincludes\class-block-bindings.php:136

Shortcodes 1

[PCRecruiter] PCRecruiter-Extensions.php:795
WordPress Hooks 100
actionrest_api_initincludes\class-block-bindings.php:26
actionenqueue_block_editor_assetsincludes\class-block-bindings.php:27
actionwp_footerincludes\class-block-bindings.php:242
actioninitincludes\class-block-bindings.php:341
actionadmin_enqueue_scriptsincludes\class-deactivation-handler.php:18
actionadmin_footerincludes\class-deactivation-handler.php:20
filtermanage_job_posts_columnsincludes\class-job-manager.php:99
actionmanage_job_posts_custom_columnincludes\class-job-manager.php:100
filtermanage_edit-job_sortable_columnsincludes\class-job-manager.php:101
actionpre_get_postsincludes\class-job-manager.php:102
filterposts_clausesincludes\class-job-manager.php:176
actioninitincludes\class-job-manager.php:662
actionwp_footerincludes\class-job-manager.php:2421
filtertemplate_includeincludes\class-job-manager.php:2901
actionwp_headincludes\class-optimization-exclusions.php:32
filterstyle_loader_tagincludes\class-optimization-exclusions.php:35
actionwpincludes\class-optimization-exclusions.php:38
filterpcrecruiter_iframe_attributesincludes\class-optimization-exclusions.php:121
filterrocket_defer_inline_exclusionsincludes\class-optimization-exclusions.php:134
filterrocket_exclude_defer_jsincludes\class-optimization-exclusions.php:142
filterrocket_delay_js_exclusionsincludes\class-optimization-exclusions.php:150
filterrocket_lazyload_iframe_exclusionsincludes\class-optimization-exclusions.php:157
filterrocket_exclude_jsincludes\class-optimization-exclusions.php:164
filterautoptimize_filter_js_excludeincludes\class-optimization-exclusions.php:181
filterautoptimize_filter_js_excludeincludes\class-optimization-exclusions.php:187
filterlitespeed_optimize_js_excludesincludes\class-optimization-exclusions.php:203
filterwp-optimize-minify-excluded-jsincludes\class-optimization-exclusions.php:222
filterperfmatters_delay_js_exclusionsincludes\class-optimization-exclusions.php:239
filterperfmatters_defer_js_exclusionsincludes\class-optimization-exclusions.php:247
filterwpacu_do_not_minify_listincludes\class-optimization-exclusions.php:264
filterflying_press_exclude_jsincludes\class-optimization-exclusions.php:281
filterflying_press_delay_js_excludeincludes\class-optimization-exclusions.php:288
filterwpfc_exclude_jsincludes\class-optimization-exclusions.php:305
actionwpincludes\class-schema-frontend.php:34
actionwp_footerincludes\class-schema-frontend.php:156
actionwp_footerincludes\class-schema-frontend.php:185
actionadmin_menuincludes\class-schema-mapper.php:34
actionadmin_initincludes\class-schema-mapper.php:35
actionadmin_enqueue_scriptsincludes\class-schema-mapper.php:36
actionwp_headincludes\class-seo-enhancements.php:23
filterpre_get_document_titleincludes\class-seo-enhancements.php:30
filterdocument_title_partsincludes\class-seo-enhancements.php:31
filterwp_titleincludes\class-seo-enhancements.php:32
actionafter_setup_themeincludes\class-seo-enhancements.php:35
filterwpseo_titleincludes\class-seo-enhancements.php:38
filterwpseo_metadescincludes\class-seo-enhancements.php:39
filterwpseo_opengraph_descincludes\class-seo-enhancements.php:40
filteraioseo_titleincludes\class-seo-enhancements.php:43
filteraioseo_descriptionincludes\class-seo-enhancements.php:44
filterwpseo_json_ld_outputincludes\class-seo-enhancements.php:48
filteraioseo_schema_outputincludes\class-seo-enhancements.php:51
filteret_titleincludes\class-seo-enhancements.php:119
actionwpincludes\class-seo-enhancements.php:120
filterelementor/frontend/the_titleincludes\class-seo-enhancements.php:129
filterfl_builder_seo_titleincludes\class-seo-enhancements.php:134
filteravada_seo_titleincludes\class-seo-enhancements.php:139
filterastra_the_titleincludes\class-seo-enhancements.php:144
filterwp_sitemaps_post_typesincludes\class-sitemap-integration.php:21
filterwp_sitemaps_posts_entryincludes\class-sitemap-integration.php:22
filterwp_sitemaps_posts_query_argsincludes\class-sitemap-integration.php:23
filterwpseo_sitemap_entryincludes\class-sitemap-integration.php:25
filterwpseo_exclude_from_sitemap_by_post_idsincludes\class-sitemap-integration.php:26
filterrank_math/sitemap/entryincludes\class-sitemap-integration.php:28
filterrank_math/sitemap/exclude_postincludes\class-sitemap-integration.php:29
actionplugins_loadedPCRecruiter-Extensions.php:46
actioninitPCRecruiter-Extensions.php:70
actioninitPCRecruiter-Extensions.php:98
actioninitPCRecruiter-Extensions.php:99
actionsave_post_jobPCRecruiter-Extensions.php:102
actionsave_post_jobPCRecruiter-Extensions.php:103
actiondelete_postPCRecruiter-Extensions.php:105
actionplugins_loadedPCRecruiter-Extensions.php:113
actioninitPCRecruiter-Extensions.php:200
actioninitPCRecruiter-Extensions.php:214
actionsave_post_jobPCRecruiter-Extensions.php:217
actiondelete_postPCRecruiter-Extensions.php:218
actionwp_headPCRecruiter-Extensions.php:319
actionwpPCRecruiter-Extensions.php:434
actionwp_enqueue_scriptsPCRecruiter-Extensions.php:554
filterquery_varsPCRecruiter-Extensions.php:562
filterthe_contentPCRecruiter-Extensions.php:582
filterthe_contentPCRecruiter-Extensions.php:595
filterthe_contentPCRecruiter-Extensions.php:600
filterthe_contentPCRecruiter-Extensions.php:647
filterbody_classPCRecruiter-Extensions.php:650
filterpost_classPCRecruiter-Extensions.php:666
actiontemplate_redirectPCRecruiter-Extensions.php:704
actionparse_requestPCRecruiter-Extensions.php:800
filterallowed_redirect_hostsPCRecruiter-Extensions.php:842
actiontemplate_redirectPCRecruiter-Extensions.php:855
filterwpseo_canonicalPCRecruiter-Extensions.php:937
actionwpPCRecruiter-Extensions.php:939
actionpcrecruiter_feedPCRecruiter-Extensions.php:964
actionadmin_menuPCRecruiter-Extensions.php:1043
actionadmin_initPCRecruiter-Extensions.php:1044
actionupdate_option_pcrecruiter_feed_optionsPCRecruiter-Extensions.php:1887
actionadmin_initPCRecruiter-Extensions.php:1900
actionadmin_post_pcrecruiter_manual_feed_updatePCRecruiter-Extensions.php:1922
actionadmin_noticesPCRecruiter-Extensions.php:1941
actionadmin_enqueue_scriptsPCRecruiter-Extensions.php:1967

Scheduled Events 2

pcrecruiter_feed
pcrecruiter_feed
Maintenance & Trust

PCRecruiter Extensions Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedFeb 12, 2026
PHP min version7.4
Downloads11K

Community Trust

Rating0/100
Number of ratings0
Active installs300
Developer Profile

PCRecruiter Extensions Developer Profile

mstdev

1 plugin · 300 total installs

99
trust score
Avg Security Score
99/100
Avg Patch Time
2 days
View full developer profile
Detection Fingerprints

How We Detect PCRecruiter Extensions

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/pcrecruiter-extensions/assets/css/pcr-job-listings.css/wp-content/plugins/pcrecruiter-extensions/assets/js/pcr-job-listings.js/wp-content/plugins/pcrecruiter-extensions/assets/css/pcr-job-detail.css/wp-content/plugins/pcrecruiter-extensions/assets/js/pcr-job-detail.js/wp-content/plugins/pcrecruiter-extensions/assets/css/pcr-iframe-embed.css/wp-content/plugins/pcrecruiter-extensions/assets/js/pcr-iframe-embed.js
Script Paths
/wp-content/plugins/pcrecruiter-extensions/assets/js/pcr-job-listings.js/wp-content/plugins/pcrecruiter-extensions/assets/js/pcr-job-detail.js/wp-content/plugins/pcrecruiter-extensions/assets/js/pcr-iframe-embed.js
Version Parameters
pcrecruiter-extensions/assets/css/pcr-job-listings.css?ver=pcrecruiter-extensions/assets/js/pcr-job-listings.js?ver=pcrecruiter-extensions/assets/css/pcr-job-detail.css?ver=pcrecruiter-extensions/assets/js/pcr-job-detail.js?ver=pcrecruiter-extensions/assets/css/pcr-iframe-embed.css?ver=pcrecruiter-extensions/assets/js/pcr-iframe-embed.js?ver=

HTML / DOM Fingerprints

CSS Classes
pcrecruiter-job-listingpcr-job-detail-containerpcr-job-detail-headerpcr-job-detail-contentpcrecruiter-iframe-wrapper
HTML Comments
<!-- PCRecruiter Job Listing Start --><!-- PCRecruiter Job Listing End --><!-- PCRecruiter Job Detail Start --><!-- PCRecruiter Job Detail End -->+2 more
Data Attributes
data-pcrecruiter-job-iddata-pcrecruiter-listing-iddata-pcrecruiter-embed-url
JS Globals
PCRJobListingsPCRJobDetailPCRIframeEmbed
REST Endpoints
/wp-json/pcrecruiter-extensions/v1/jobs/wp-json/pcrecruiter-extensions/v1/job/(?P<id>[\d]+)
Shortcode Output
[pcrecruiter_job_listings][pcrecruiter_job_detail][pcrecruiter_iframe_embed]
FAQ

Frequently Asked Questions about PCRecruiter Extensions