LiveActive security incident?Get immediate response
CVE Record

CVE-2021-39334: Job Board Vanila Plugin <= 1.0 Authenticated Stored Cross-Site Scripting

The Job Board Vanila WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via the psjb_exp_in and the psjb_curr_in parameters found in the ~/job-settings.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.

MediumCVSS 5.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a stored cross-site scripting issue in the Job Board Vanila WordPress plugin version 1.0 and earlier. A highly privileged user could save script content through plugin settings, affecting sites where administrators cannot normally use unfiltered HTML.

Executive priority

Treat as a targeted WordPress hygiene issue, not an emergency. Prioritize if the plugin is installed on public or business-critical sites, especially where multiple administrators or multisite delegation exists.

Technical view

CVE-2021-39334 is CWE-79 stored XSS via insufficient validation and sanitization of psjb_exp_in and psjb_curr_in in job-settings.php. The CVSS 3.1 score is 5.5 with high privileges required and changed scope.

Likely exposure

Exposure is limited to WordPress sites running Job Board Vanila plugin version 1.0 or earlier, especially multisite installations or configurations where unfiltered_html is disabled for administrators.

Exploitation context

No active exploitation evidence is provided. The CVE is not listed as KEV, and the supplied sources do not claim exploitation in the wild. Exploitation requires authenticated administrative access.

Researcher notes

The supplied evidence identifies vulnerable parameters and source path, but does not name a fixed release. Validation should stay focused on version, configuration, privilege model, and vendor status rather than assuming broader plugin exposure.

Mitigation direction

  • Inventory WordPress sites for Job Board Vanila plugin version 1.0 or earlier.
  • Check vendor or WordPress plugin guidance for a fixed version or retirement status.
  • Disable or remove the plugin if it is unused or no supported fix exists.
  • Restrict administrator access to trusted accounts only.
  • Review admin accounts for unnecessary privileges.

Validation and detection

  • Confirm whether Job Board Vanila is installed and enabled.
  • Record the installed plugin version on each WordPress site.
  • Check whether multisite or unfiltered_html restrictions apply.
  • Review recent changes to affected job board settings.
  • Audit administrator accounts for unexpected access.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-79: User-session and phishing behavior lookup

Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-39334 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.5CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N2.32.7Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

5.5Medium
CVSS 3.1 vector shape for CVE-2021-39334Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Job Board Vanila PluginJob Board Vanila Plugin1.0Listed
Weakness

CWE details

CWE-79

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.