CVE-2026-25376: Reflected XSS in Addon Jobsearch Chat

An attacker could exploit this Reflected XSS vulnerability by crafting a malicious URL containing JavaScript code. When a user clicks on this URL, the injected script executes in their browser within the context of the Addon Jobsearch Chat plugin. This allows the attacker to steal cookies, redirect the user to a phishing site, or modify the content of the page. The impact is particularly severe if the plugin is used on sensitive pages or handles user authentication, as an attacker could potentially gain access to user accounts and sensitive data. The blast radius extends to all users who interact with the vulnerable plugin, especially those who click on links from untrusted sources.

1. Reserved2026-02-02
2. Published2026-03-25
3. Modified2026-04-28
4. EPSS updated2026-04-02

The primary mitigation for CVE-2026-25376 is to immediately upgrade the Addon Jobsearch Chat plugin to version 3.1 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) rule to filter out potentially malicious URL parameters. Specifically, look for URL parameters containing JavaScript code or suspicious characters. Additionally, carefully review and sanitize all user input before displaying it on the page. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload into a URL parameter and verifying that it does not execute.