Security readout for executives and security teams
Plain-English summary
CVE-2015-9404 reports cross-site scripting in the WordPress neuvoo-jobroll plugin 2.0 through neuvoo_keywords. Affected sites could expose users or administrators to injected browser script. The public record provides limited detail, no CVSS score, and no confirmed active exploitation signal.
Executive priority
Treat this as an exposure-verification item. If neuvoo-jobroll 2.0 is installed, prioritize removal or vendor-confirmed remediation because WordPress plugin XSS can affect users and administrators.
Technical view
The bundle identifies an XSS issue in neuvoo_keywords for neuvoo-jobroll 2.0. The CVE affected-products fields are n/a, but the description and references name the WordPress plugin and version. No CWE, CVSS vector, patch version, or vendor mitigation is provided in the supplied sources.
Likely exposure
Exposure is source-supported only for WordPress sites running neuvoo-jobroll plugin 2.0. The bundle does not identify other affected versions, CPEs, deployment prerequisites, or whether the plugin is actively maintained.
Exploitation context
The CVE is not listed as KEV in the supplied bundle. Packet Storm is cited as a public reference, which indicates public disclosure, but the sources do not establish active exploitation or exploitation at scale.
Researcher notes
Evidence is sparse. The strongest supported facts are plugin name, version 2.0, neuvoo_keywords XSS, public disclosure references, and no KEV signal. Do not infer affected versions, exploit maturity, authentication requirements, or fixed releases from this bundle.
Mitigation direction
- Inventory WordPress sites for neuvoo-jobroll and confirm exact plugin version.
- If version 2.0 is present, review vendor or WordPress plugin guidance.
- Disable or remove the plugin if no maintained fixed version is available.
- Monitor WordPress pages and administrative areas for unexpected script injection indicators.
Validation and detection
- Check WordPress plugin inventory for neuvoo-jobroll version 2.0.
- Review plugin changelog or WordPress plugin page for maintenance and fix information.
- Inspect web logs for suspicious requests involving neuvoo_keywords.
- Confirm compensating controls do not rely on unverified assumptions about exploitability.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2015-9404 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wordpress.org/plugins/neuvoo-jobroll/#developersCVE reference · x_refsource_MISC
- https://packetstormsecurity.com/files/134240/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.