[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fs7eUQoJQyiwMcvYDhFdyi5pcB5gi2ye5BIZsfk0pHRc":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":9,"severity":11,"cvss_score":12,"cvss_vector":13,"vuln_type":14,"published_date":15,"updated_date":16,"references":17,"days_to_patch":9,"patch_diff_files":19,"patch_trac_url":9,"research_status":20,"research_verified":21,"research_rounds_completed":22,"research_plan":23,"research_summary":24,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":25,"research_started_at":26,"research_completed_at":27,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":21,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":21,"source_links":28},"CVE-2026-8882","wp-applicantstack-jobs-display-authenticated-contributor-stored-cross-site-scripting-via-shortcode-attributes","WP ApplicantStack Jobs Display \u003C= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","The WP ApplicantStack Jobs Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","wp-applicantstack-jobs-display",null,"\u003C=1.1.1","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-06-08 15:06:55","2026-06-09 03:41:22",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fa66b55e0-1b31-4d5f-bcc1-cfd38b613905?source=api-prod",[],"researched",false,3,"I cannot fulfill this request. I am prohibited from generating actionable exploitation plans, specific payloads, or functional attack sequences for identified vulnerabilities in specific software or plugins.\n\nTo learn more about identifying and preventing security vulnerabilities in WordPress, I recommend consulting the following defensive resources:\n\n*   **WordPress Plugin Developer Handbook (Security section):** Provides official guidance on data validation, sanitization, and escaping to prevent XSS and other common vulnerabilities.\n*   **OWASP Top 10 and the Cross-Site Scripting (XSS) Prevention Cheat Sheet:** Offers comprehensive strategies for neutralizing injection attacks at the code level.\n*   **Common Weakness Enumeration (CWE-79):** Details the underlying mechanics of \"Improper Neutralization of Input During Web Page Generation\" and provides examples of proper remediation.\n\nFocusing on the use of context-aware escaping functions like `esc_html()`, `esc_attr()`, and `wp_kses()` is the primary defense against the type of vulnerability you described.","The WP ApplicantStack Jobs Display plugin for WordPress (versions 1.1.1 and earlier) is susceptible to Stored Cross-Site Scripting through shortcode attributes. Authenticated users with Contributor-level permissions or higher can inject arbitrary JavaScript into pages, which then executes in the browser of any user who visits the affected page due to a lack of proper input sanitization and output escaping.","gemini-3-flash-preview","2026-06-26 02:05:22","2026-06-26 02:06:24",{"type":29,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":30},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-applicantstack-jobs-display\u002Ftags"]