{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32493", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-03-12T11:12:00.510Z", "datePublished": "2026-03-25T16:14:59.078Z", "dateUpdated": "2026-03-25T20:13:18.821Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://codecanyon.net", "defaultStatus": "unaffected", "packageName": "wp-jobsearch", "product": "JobSearch", "vendor": "eyecix", "versions": [{"changes": [{"at": "3.2.2", "status": "unaffected"}], "lessThanOrEqual": "<= 3.2.0", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Phat RiO | Patchstack Bug Bounty Program"}], "datePublic": "2026-03-25T17:12:37.521Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch allows Reflected XSS.<p>This issue affects JobSearch: from n/a through <= 3.2.0.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch allows Reflected XSS.This issue affects JobSearch: from n/a through <= 3.2.0."}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "Reflected XSS"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-03-25T16:14:59.078Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/wp-jobsearch/vulnerability/wordpress-jobsearch-plugin-3-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "title": "WordPress JobSearch plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32493", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T20:11:00.627059Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T20:13:18.821Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32493", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T20:11:00.627059Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T18:49:11.365Z"}}], "cna": {"title": "WordPress JobSearch plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Phat RiO | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "Reflected XSS"}]}], "affected": [{"vendor": "eyecix", "product": "JobSearch", "versions": [{"status": "affected", "changes": [{"at": "3.2.2", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "<= 3.2.0"}], "packageName": "wp-jobsearch", "collectionURL": "https://codecanyon.net", "defaultStatus": "unaffected"}], "datePublic": "2026-03-25T17:12:37.521Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/wp-jobsearch/vulnerability/wordpress-jobsearch-plugin-3-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch allows Reflected XSS.This issue affects JobSearch: from n/a through <= 3.2.0.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch allows Reflected XSS.<p>This issue affects JobSearch: from n/a through <= 3.2.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-03-25T16:14:59.078Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32493", "state": "PUBLISHED", "dateUpdated": "2026-03-25T20:13:18.821Z", "dateReserved": "2026-03-12T11:12:00.510Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-25T16:14:59.078Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch allows Reflected XSS.This issue affects JobSearch: from n/a through <= 3.2.0."}], "id": "CVE-2026-32493", "lastModified": "2026-03-25T17:17:00.970", "metrics": {}, "published": "2026-03-25T17:17:00.970", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/wp-jobsearch/vulnerability/wordpress-jobsearch-plugin-3-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "audit@patchstack.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.2.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.2.2"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "JobSearch", "source": "cna", "vendor": "eyecix"}, "product": "jobsearch", "vendor": "eyecix"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-25T19:24:00.264895+00:00", "value": {"mitigation_remediation": ["Upgrade the eyecix JobSearch WordPress plugin to version 3.2.1 or newer that contains an input sanitization fix."], "summary": {"action": "Immediate Patch", "impact": "Cross\u2011Site Scripting allows arbitrary script execution in the victim\u2019s browser."}, "threat_synthesis": {"affected_systems": "WordPress sites that have the eyecix JobSearch plugin installed in any version up to and including 3.2.0 are vulnerable. This includes any deployment that has not yet upgraded to the newer releases that contain the fix. Sites relying on older versions of the plugin remain at risk.", "description_and_impact": "This vulnerability arises from improper neutralization of input during web page generation. As a result, a malicious actor can embed and return arbitrary JavaScript code that is executed in the victim\u2019s browser. The weakness is a classic cross\u2011site scripting flaw (CWE\u201179), enabling actions such as cookie theft, session hijacking, defacement or redirection to malicious sites. The plugin fails to escape or validate user\u2011supplied data that is reflected back to the page, creating a direct path for script injection.", "risk_and_exploitability": "Based on the description, it is inferred that the attack can be performed by delivering a specially crafted URL or form input that is reflected by the plugin\u2019s output. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the flaw is known to be high risk due to its ease of exploitation and broad impact. Because the vulnerability is client\u2011side, an attacker only needs to entice a user to visit the carefully constructed link; authentication or elevated privileges are not required."}}}}, "created": "2026-03-25T21:43:35.592715+00:00", "updated": "2026-03-26T11:37:34.789654+00:00", "vendors": ["eyecix", "eyecix$PRODUCT$jobsearch", "wordpress", "wordpress$PRODUCT$wordpress"]}