Input validation vulnerability in Careerfy – Job Board WordPress Theme 3.9.0

The Careerfy – Job Board WordPress Theme, up to and including version 3.9.0, is vulnerable to a type of attack called Stored Cross-Site Scripting. This type of attack allows an authenticated attacker to inject malicious web scripts into pages. When a user visits one of these pages, the malicious script will execute and can cause harm to the user. The fields in the theme that are vulnerable to this type of attack are the ‘Career Level’, ‘Experience’, ‘Gender’, ‘Industry’, ‘Qualifications’, ‘Job Description’, and ‘Full Address’ fields due to insufficient input sanitization and output escaping.